6 ms·
Analyzing the attacks on my website
- testomono 7y agomaybe you should simple add whitelist nftables ssh port 22 you ips
- bdcravens 7y agoBlindly blocking IP addresses seems like a bad idea; how many are DHCP'ed residential addresses with a short lease?
- tpetry 7y agoIsn’t this the concept of the fail2ban software used on almost every linux server?
- m-p-3 7y agoI have some personal services that I frankly don't expect or want many outsiders, and it's extremely unlikely they'd come from China so I just blacklist a chunk of IPs.
- myself248 7y agoDoes anyone do short leases anymore? My cablemodem is technically assigned by DHCP, but it hasn't changed in years.
- milankragujevic 7y agoYes, DSL and mobile broadband.
- hellotomyrars 7y agoWidely varies in provider. I’ve had providers who, for a business customer no less, had incredibly short-lived DHCP leases. Presumably to help motivate the business customer to pay them for a Static IP.
- yokaze 7y agoSo, a couple of random people are trying standard passwords. That should be a complete non-issue, if your system is correctly configured. Now you want to stop the users and your response is to block "their" IP completely. Which turned the non-issue into self-made denial of service "attack". As those ips are not bound to users and "they" will potentially come from the whole ip space script-kiddies can come from.
- ringzero 7y agoYou may have accidentally reinvented https://en.wikipedia.org/wiki/Fail2ban https://en.wikipedia.org/wiki/Fail2ban :)
- JeremyMorgan 7y agoThat wasn't really the point of the article, I'm showing how to gather data on where they came from. Blocking is completely optional, and not for everyone.
- bdamm 7y agofail2ban is saving my bacon right now.
- ryanlol 7y agoFrom what? Generally fail2ban only exposes unnecessary attack surface while providing zero benefit.
- omgwtfbyobbq 7y agoHow does fail2ban expose attack surface?
- detaro 7y agoIt's code running on partially attacker-controlled inputs. It several times had vulnerabilities that allowed an attacker to trigger blocks for arbitrary IPs.
- cyc115 7y agoI remember there's a privEsc on old versions of fail2ban.
- omgwtfbyobbq 7y agoDo you remember roughly when the privEsc was? https://www.cvedetails.com/vulnerability-list/vendor_id-5567/Fail2ban.html https://www.cvedetails.com/vulnerability-list/vendor_id-5567...
- david_draco 7y agoI would bet that these attacks are coming through Tor, and the country distribution is just the distribution of Tor exit nodes.
- JeremyMorgan 7y agoI wondered about that same thing. Obviously the "where the attacks came from" portion will never be 100% accurate.
- scrps 7y agoIf you are interested, Tor keeps a list of exit nodes you could compare against. I'd be curious to see how many are exit nodes. https://check.torproject.org/exit-addresses https://check.torproject.org/exit-addresses
- olivierduval 7y ago... or just some servers compromised by a malware, used as a proxy
- kjaftaedi 7y agoThat's so interesting. I built literally the exact same thing the other weekend. I took all of the data and fed it into a database, then built a web interface so I could see the data better. It's looking like this: https://i.imgur.com/8G9GAUp.png https://i.imgur.com/8G9GAUp.png Lots more activity from France than I would have expected compared to other countries. Also lots more people using Amazon's infrastructure to scan the internet than I would have imagined. Other than that it's about what you'd expect. So far I don't find this to be overly practical because with the amount of IP addresses in the filter, the firewall takes forever to reload. (firewalld)
- _wldu 7y agoYou can use ipset to block them. It's hash based and efficient. http://ipset.netfilter.org/ http://ipset.netfilter.org/ http://mikhailian.mova.org/node/194 http://mikhailian.mova.org/node/194
- JeremyMorgan 7y agoAwesome, that really looks nice! I'm hoping to build some sort of auto-generated HTML page on my site just for fun. Yours looks great.
- barrkel 7y agoFunny, because the first thing I thought was how frustrating it was to read. The %s are not sorted by size in the pie chart, and they're not labelled other than by colour, so you can't read the % for each country. The attempts per hour seems to cover more than 24 hours, but the dates aren't labelled. An aggregate chart bucketed by hour of day would be more interesting, since the actual rate is quite low and has a lot of variance - at this zoom level, it's basically noise. I agree it looks pretty, though I'd take a table with some bar chart columns.
- kjaftaedi 7y agoThe charts are interactive, you can hover each slice to get names and percentages, or each name to find it on the chart. I found it wasn't really worth doing more with the chart, since its purpose was really just comparing the largest offenders. Regarding the time frames, the buttons in the top right allow choosing the time frame. today, yesterday, 48 hours, week, month, year. I also slapped this together in half a day.. there is plenty of room for improvement, and more charts and options could easily be added. I didn't take this very far because this was not my goal, it was just a quick idea to allow me to block others from being able to query my server while still allowing me access from anywhere in the world. The visualizations were just for fun.
- mgiampapa 7y agoBut why would these attacks be in your logs to begin with? Who leaves authentication open to the internet at all? I'm more concerned about the failure to minimize attack surface. This is security 101.
- yjftsjthsd-h 7y agoBecause I need to log in from the internet?
- bdamm 7y agoWhat's the point of a shell host if I can't log in to it?
- erikbye 7y agoSSH doesn't have to be exposed to the Internet, use VPN.
- alexchamberlain 7y agoDoesn’t that just move the problem?
- erikbye 7y agoWell, no. As evidenced SSH is a very exposed surface that is commonly brute-force attacked. A VPN is less exposed, less commonly attacked, it offers much more control of authorization (clients, devices, 2fa) and monitoring. And, now your server might not even need a public IP. It is with good reason companies have used this method as standard practice for decades for remote access. Besides, for many use-cases, SSH is not the only service you need to access remotely.
- prebrov 7y agoVPN, or any other network segmentation does, indeed, just shift the attack surface, and often creates a false sense of security behind a network perimeter. Google, for example, proposes a different school of thought – zero trust network, and strong contextual authentication of each individual request. Precisely because you need to expose more services to more users, you need to be extremely conscious about treating singular network ingress point as a primary security gateway. Check out https://beyondcorp.com https://beyondcorp.com, it’s a very interesting concept.
- nubb 7y agoUse fail2ban :]
- bepvte 7y agoUsing ipsets (hash table type thing) is much more efficient then iptables rules, especially if you use entire ip blocks
- rvz 7y agoOr Just use fail2ban + moving your services to a non-standard higher port without even "dealing" with an attack in the first place.
- JeremyMorgan 7y agoI generally don't "deal" with them anyway, these are failed attempts. I put the "block" in there in case readers were wondering how to block the IPs if they want to.
- indigodaddy 7y agoI disable password authentication for ssh, so I tend to rarely look at these extremely commonplace attempts. Obviously best thing is to also lock ssh access down to a jump host or two, but that’s not always feasible.
- deleted 7y ago[deleted]
- pettycashstash2 7y agoInteresting - I use Wordfence on my wordpress sites. Gives me output like this for past 30 days. IP Country Block Count 185.81.157.109 France 81 39.100.156.143 China 77 188.163.104.67 Ukraine 32 54.176.188.51 United States 31 Whats interesting is that some are coming from other compromised WordPress sites, which are for dental offices, medical offices, etc. A lot are from tor exit nodes. Its amazing that many don't realize their servers have been compromised and used for nefarious purposes.
- _prototype_ 7y agoAnyone can think of a particular reason as to why his website is being targeted by the Chinese?
- mr_toad 7y agoWhy wouldn’t it be? These scripts attack every site, all day every day. Not a minute goes by without someone (or some bot) attempting some sort of attack on my website.
- JeremyMorgan 7y agoI don't think my site is being "targeted" more than any other in my ip range. This is all automated stuff that gets dumped off anyway.
- erikbye 7y agoIt's not targeted and has nothing to do with the box running a web server. These brute force login attempts starts only minutes after you put a new server with SSH exposed online. Using default passwords and usernames like: admin, support, user, user2, student2, gitlab, git, postgres, cisco, root, ts3user, deploy, vagrant, jenkins, ftptest, 224, 130, dbadmin, sinusbot, mc, daniel, weblogic, guest, redmine, teamspeak, etc. Checked a random box, lastb | wc -l shows 38k attempts since Feb 1.
- deleted 7y ago[deleted]
- Trias11 7y ago... or Splunk
- jldevops 7y agoNice. I actually built something very similar a few years ago. Instead of using Maxmind to check the IP to find the country of origin and some other information, I used Shodan.io. Nice dashboard tho, that's a good idea. I made my data into an html map that you could save. https://github.com/JLDevOps/Authr https://github.com/JLDevOps/Authr
- JeremyMorgan 7y agoThat is pretty awesome! Thank you for sharing.
- deleted 7y ago[deleted]
- musiccog 7y agoI used to work for an Australian h/w and s/w company that manufactures in South Korea. Our office was attacked within 10 minutes of going online from ip addresses allocated to China. Thanks to OpenNMS, nfsen and nfsight. Great programs.
- ilogik 7y ago> But I want to see how many attacks from each continent. So I call on my old friend awk for that I don't understand what awk is accomplishing here. To get the count, just use uniq -c which you are doing (tip, you can also do a sort -rn after that) the awk command looks like a noop to me, if you've only got the continents in the file
- archi42 7y agoBrute force attempts in servers are pretty old news. If you're running a public facing ssh server, it will be found and it will be tried. My solution is to disable passwords and put the server on a non-standard port (yeah, users could try to crash sshd and steal its port, but then my ssh client will complain about a key mismatch; if my servers actually had other users I'd probably consider using iptables to forward all incoming traffic on port 12345 to 22 instead, and drop other non-forwarded traffic on 22). If you don't trust your users to have strong passwords and are forced to allow passwords, use fail2ban. Edit: With the prominent pluralsight ads this link feels like an ad overall.
- dredmorbius 7y agoAnother useful classification is to get the ASN and CIDR block the attacks are coming from, allowing broader blocks or rate-limiting from high-noise / high-attack network space. The Routeviews project (https://www.routeviews.org/ https://www.routeviews.org/) provides a reverse-lookup which returns ASN and CIDR for a given IP. For example: $ host -t txt 240.230.216.209.asn.routeviews.org 240.230.216.209.asn.routeviews.org descriptive text "21581" "209.216.230.0" "24" That's the ASN (AS21581 -- M5HOSTING / M5 Computer Security) and CIDR block (209.216.230.0/24) for news.ycombinator.com, a/k/a 209.216.230.240. What I've frequently found is that hostile traffic is fairly highly concentrated among bad-actor space, often datacentres with little reason to be generating end-user traffic or HTTP requests. Though that includes a surprisingly large quantity of web crawlers (few of which belong to any organisations you've heard of).
- dredmorbius 7y agoAnd for those individuals (or organisations) making heavy use of the resource, the zonefiles are downloadable, for local query capabilities / reduced latency.