4 ms·

The joys of maintaining your own server

30 points by lnenad 7y ago

Havoc 7y ago
If you change the SSH port be sure to tell fail2ban about that. ;)
flowiz 7y ago
Well yeah internet is full of bots scanning for vulnerabilities, nothing new here. Am I missing the point of this post?
- makapuf 7y ago
  If its known for 10 years and not repeated, imagine how many people could benefit from hearing it for the first time (or since it's useful to hear this 5 times how many still need 4 more times)
- lnenad 7y ago
  Hey there, sorry if the point isn't clear, but, at least in my experience, the situation was different 10 years ago, there weren't as many bots, and you had to be guilty of success before being targeted. Nowadays all you need to do to be a target for bots is to exist.
  - bordercases 7y ago
    What did you do such that we could trust your take?
    - lnenad 7y ago
      I have been working on web projects for the last ~15 years.
  - Terretta 7y ago
    Not really new situation. Unpatched builds of Windows NT server or Windows XP desktop turned on with public IP would be ‘owned’ in about 30 seconds > 15 years ago. Basically, before the bot nets come the worms: https://en.wikipedia.org/wiki/Computer_worm https://en.wikipedia.org/wiki/Computer_worm
- ajflores1604 7y ago
  I've run a home server as a remote programming environment for a year now and I've never bothered to look at the logs. It was cool to see. While it's obvious to ppl who have used tech for years, with YouTube and how easy it is to pick up programming and start a simple raspberry pi project, there's lots of new ppl to this field who just aren't aware that their home network is being queried constantly.
PureParadigm 7y ago
The number of unauthorized SSH attempts will also very much depend on your IP address. I've hosted my own SSH server at home and from a university dorm room. At university, I'd get way more attacks (usually from foreign IPs) than at home. Also, on IPv6-only, I got zero attacks. I run everything behind a Wireguard VPN now, so I don't know how things have changed in the past few years. It would be interesting to see an analysis of attempts based on IP address type (residential, business, various universities, various clouds). How does the number of attacks compare within and between these categories? Perhaps there could be a cool graphic with arrows (or some other indicator) showing where attacks are coming from and targeting.
shekharshan 7y ago
I had enabled the port forwarding on my home router for 5 hours, so I could get into my home server. I saw exactly same log pattern on my server’s ssh logs.

30 points by lnenad 7y ago

Havoc 7y ago

If you change the SSH port be sure to tell fail2ban about that. ;)

flowiz 7y ago

Well yeah internet is full of bots scanning for vulnerabilities, nothing new here. Am I missing the point of this post?

makapuf 7y ago
If its known for 10 years and not repeated, imagine how many people could benefit from hearing it for the first time (or since it's useful to hear this 5 times how many still need 4 more times)
lnenad 7y ago
Hey there, sorry if the point isn't clear, but, at least in my experience, the situation was different 10 years ago, there weren't as many bots, and you had to be guilty of success before being targeted. Nowadays all you need to do to be a target for bots is to exist.
- bordercases 7y ago
  What did you do such that we could trust your take?
  - lnenad 7y ago
    I have been working on web projects for the last ~15 years.
- Terretta 7y ago
  Not really new situation. Unpatched builds of Windows NT server or Windows XP desktop turned on with public IP would be ‘owned’ in about 30 seconds > 15 years ago. Basically, before the bot nets come the worms: https://en.wikipedia.org/wiki/Computer_worm https://en.wikipedia.org/wiki/Computer_worm
ajflores1604 7y ago
I've run a home server as a remote programming environment for a year now and I've never bothered to look at the logs. It was cool to see. While it's obvious to ppl who have used tech for years, with YouTube and how easy it is to pick up programming and start a simple raspberry pi project, there's lots of new ppl to this field who just aren't aware that their home network is being queried constantly.

PureParadigm 7y ago

The number of unauthorized SSH attempts will also very much depend on your IP address. I've hosted my own SSH server at home and from a university dorm room. At university, I'd get way more attacks (usually from foreign IPs) than at home. Also, on IPv6-only, I got zero attacks. I run everything behind a Wireguard VPN now, so I don't know how things have changed in the past few years. It would be interesting to see an analysis of attempts based on IP address type (residential, business, various universities, various clouds). How does the number of attacks compare within and between these categories? Perhaps there could be a cool graphic with arrows (or some other indicator) showing where attacks are coming from and targeting.

shekharshan 7y ago

I had enabled the port forwarding on my home router for 5 hours, so I could get into my home server. I saw exactly same log pattern on my server’s ssh logs.