3 ms·

Caution for folks: I ran this for a few weeks and it was very informative. You see how simple many attacks really are, how many corporate assets are comprimised

by mergy 7y ago

Caution for folks: I ran this for a few weeks and it was very informative. You see how simple many attacks really are, how many corporate assets are comprimised, and where most of the source attacking countries are. But, there is a downside. The downside is any site you put it on will be flagged and attacked 100x more since it registers as a vulnerable destination. After turning it off, the deluge of attacks for the site continues and I ended-up rigging a fail2ban setup to just deny if a destination port is hit. (See >> https://mergy.org/2019/08/setting-up-a-killswitch-for-attacks-with-ufw-and-fail2ban-on-ubuntu-linux/ https://mergy.org/2019/08/setting-up-a-killswitch-for-attack...) But, it is fun and interesting to see. Highly recommend but know the legacy on that as well.

gchamonlive 7y ago
You should not put this alongside your site, at least not sharing resources. You should apply forwarding rules to separate this into a different vlan or vpc (ip based routing for instance) and completely isolate this from your site, while the two ssh destinations would be indistinguishable from the outside, preferably behind a load balancer with a firewall to mitigate ddos attacks and just log different attack types
mergy 7y ago
Here is what a playmaker session looks like if you are interested https://vimeo.com/345068825/86f8c8f97e https://vimeo.com/345068825/86f8c8f97e
LinuxBender 7y ago
Agreed, it's mostly old bots trying to take over wordpress sites and serve malware. That's about it. For a while, I gathered attempted usernames. I created accounts for all the usernames, set a null password on my chroot sftp server. I was really hoping they would try to upload something interesting. Nope. If they can't get a standard shell, they just keep retrying in a loop, forever. I've had the same bots hitting my server every few minutes for several years. No harm, no foul, I let them have at it.

by mergy 7y ago

gchamonlive 7y ago

You should not put this alongside your site, at least not sharing resources. You should apply forwarding rules to separate this into a different vlan or vpc (ip based routing for instance) and completely isolate this from your site, while the two ssh destinations would be indistinguishable from the outside, preferably behind a load balancer with a firewall to mitigate ddos attacks and just log different attack types

mergy 7y ago

Here is what a playmaker session looks like if you are interested https://vimeo.com/345068825/86f8c8f97e https://vimeo.com/345068825/86f8c8f97e

LinuxBender 7y ago

Agreed, it's mostly old bots trying to take over wordpress sites and serve malware. That's about it. For a while, I gathered attempted usernames. I created accounts for all the usernames, set a null password on my chroot sftp server. I was really hoping they would try to upload something interesting. Nope. If they can't get a standard shell, they just keep retrying in a loop, forever. I've had the same bots hitting my server every few minutes for several years. No harm, no foul, I let them have at it.