4 ms·

From a systems-administration standpoint, it's nice to be able to easily sift out the random bots and drive-bys from the more personal probes that maybe have a

From a systems-administration standpoint, it's nice to be able to easily sift out the random bots and drive-bys from the more personal probes that maybe have a human at the other end. There are myriad bits and bobs of software and services that promise to do anomaly detection in logs, but an easier approach for now is to just move ssh off 22. It affords basically zero extra real security but makes any subsequent login attempts more worthwhile to look at.

tptacek 6y ago
Let me gently challenge you: you've moved SSH to 7163/tcp. You see a pattern of login attempts. Now what, and why?
- thaumaturgy 6y ago
  Sure. Direct answer: search logs across all services and nodes on the network for activity from that source or netrange. See if it's targeting particular usernames, especially anything that shouldn't be guessable. Treat it first as a source of information: did I screw something up somewhere? Have we had an incident I don't know about? If it looks like nothingburger, ignore it and get on with the day. Broader answer after reading some of your other comments in this thread: in your ideal, highly secured network environment, none of this is necessary because everything's wired up tighter than a gnat's ass hole. Unfortunately I've never had the pleasure of working for one of those places.
  - tptacek 6y ago
    I guess that's fair. But: if you buy into this idea, there's a much, much better thing to do: look into Canarytokens. Canarytokens, unlike port knocking, are criminally underused. Really, you should do something similar for your off-port SSH service; don't actually _run_ SSH there, just run a stateless unprivileged service that spoofs a bit of SSH protocol and generates loud alerts. The networks I'm describing aren't "ideal" or "highly secured". I am describing table stakes. While I was at Latacora, most of the clients we engaged with were already at this level of maturity when we joined up.
    - thaumaturgy 6y ago
      Cool, thanks. I found https://blog.thinkst.com/p/canarytokensorg-quick-free-detection.html; https://blog.thinkst.com/p/canarytokensorg-quick-free-detect... is there a better writeup you have offhand? https://github.com/cowrie/cowrie https://github.com/cowrie/cowrie has been on my todo list for a while too, but more as a toy than a serious thing. > The networks I'm describing aren't "ideal" or "highly secured". I am describing table stakes. While I was at Latacora, most of the clients we engaged with were already at this level of maturity when we joined up. One of the most valuable things you do here is describe things that you believe are table stakes to people and organizations that have never heard of them. Companies like Latacora tend to self-select for clients that are at least aware that security should be a sensible line item in their quarterly budget. There are many many more organizations for whom moving ssh or even port knocking amount to a real improvement to their infrastructure. :-(
      - tptacek 6y ago
        There's: https://canary.tools/help/canarytokens https://canary.tools/help/canarytokens But the concept is really simple: come with any kind of thing you'd want to tripwire --- the AWS key is particularly slick --- and put it somewhere in your infra, then wait for alerts.
    - pwdisswordfish2 6y ago
      What happens when the attacker modifies /etc/resolv.conf, disables or does not use DNS while on the network. What if the attacker does not use software that automatically loads images, like the "canary token" tracking pixels? What is the attacker opens the files offline? Canary tokens still work? How? Why would anyone advise using canary token instead of port knocking? Makes no sense. Why not use both?
      - tptacek 6y ago
        I don't even understand the question. We were talking about the value of moving SSH to a different port to cut down on logged probes. That at least has the value of giving you a weak signal about IP sources that are somewhat determined to break in. Port knocking doesn't even do that.

tptacek 6y ago

Let me gently challenge you: you've moved SSH to 7163/tcp. You see a pattern of login attempts. Now what, and why?

thaumaturgy 6y ago
Sure. Direct answer: search logs across all services and nodes on the network for activity from that source or netrange. See if it's targeting particular usernames, especially anything that shouldn't be guessable. Treat it first as a source of information: did I screw something up somewhere? Have we had an incident I don't know about? If it looks like nothingburger, ignore it and get on with the day. Broader answer after reading some of your other comments in this thread: in your ideal, highly secured network environment, none of this is necessary because everything's wired up tighter than a gnat's ass hole. Unfortunately I've never had the pleasure of working for one of those places.
- tptacek 6y ago
  I guess that's fair. But: if you buy into this idea, there's a much, much better thing to do: look into Canarytokens. Canarytokens, unlike port knocking, are criminally underused. Really, you should do something similar for your off-port SSH service; don't actually _run_ SSH there, just run a stateless unprivileged service that spoofs a bit of SSH protocol and generates loud alerts. The networks I'm describing aren't "ideal" or "highly secured". I am describing table stakes. While I was at Latacora, most of the clients we engaged with were already at this level of maturity when we joined up.
  - thaumaturgy 6y ago
    Cool, thanks. I found https://blog.thinkst.com/p/canarytokensorg-quick-free-detection.html; https://blog.thinkst.com/p/canarytokensorg-quick-free-detect... is there a better writeup you have offhand? https://github.com/cowrie/cowrie https://github.com/cowrie/cowrie has been on my todo list for a while too, but more as a toy than a serious thing. > The networks I'm describing aren't "ideal" or "highly secured". I am describing table stakes. While I was at Latacora, most of the clients we engaged with were already at this level of maturity when we joined up. One of the most valuable things you do here is describe things that you believe are table stakes to people and organizations that have never heard of them. Companies like Latacora tend to self-select for clients that are at least aware that security should be a sensible line item in their quarterly budget. There are many many more organizations for whom moving ssh or even port knocking amount to a real improvement to their infrastructure. :-(
    - tptacek 6y ago
      There's: https://canary.tools/help/canarytokens https://canary.tools/help/canarytokens But the concept is really simple: come with any kind of thing you'd want to tripwire --- the AWS key is particularly slick --- and put it somewhere in your infra, then wait for alerts.
  - pwdisswordfish2 6y ago
    What happens when the attacker modifies /etc/resolv.conf, disables or does not use DNS while on the network. What if the attacker does not use software that automatically loads images, like the "canary token" tracking pixels? What is the attacker opens the files offline? Canary tokens still work? How? Why would anyone advise using canary token instead of port knocking? Makes no sense. Why not use both?
    - tptacek 6y ago
      I don't even understand the question. We were talking about the value of moving SSH to a different port to cut down on logged probes. That at least has the value of giving you a weak signal about IP sources that are somewhat determined to break in. Port knocking doesn't even do that.