6 ms·
Don’t disable port 22; just neuter it. If port 22 is disabled, the attacker will look elsewhere in your system.
by doggydogs94 6y ago
Don’t disable port 22; just neuter it. If port 22 is disabled, the attacker will look elsewhere in your system.
- vlod 6y agoDo you have a suggestion on how to do this?
- ogre_codes 6y agoAn SSH Tarpit is a good way: https://nullprogram.com/blog/2019/03/22/ https://nullprogram.com/blog/2019/03/22/
- vlod 6y agothanks!
- giovannibajo1 6y agohttps://github.com/cowrie/cowrie https://github.com/cowrie/cowrie
- tensor 6y agoThis is an interesting point. Imagine if you put a fake SSH agent on 22, it responds just like SSH but never allows a login. Would it make it even less likely that someone would bother trying another port?
- peder 6y agoObviously the next step here is a fake SSH agent that allows logins to a little sandbox.
- isbvhodnvemrwvn 6y agoProbably a bad idea, one vulnerable service invites people to look for more.
- yjftsjthsd-h 6y agoDepends what we mean by sandbox. I wouldn't make a chroot the honeypot, but I don't see an issue with a program that just simulates a shell but doesn't allow exec or real fs access, for instance.
- drtillberg 6y agoAnd the next beyond that is a sandbox that contains simulated data....
- Sohcahtoa82 6y agoI'd be weary of that. Sandboxes have been escaped.
- jrockway 6y agoI don't think you would ever let them touch OS-level resources. There are plenty of third-party ssh server libraries where you just get a Reader and a Writer to the remote end. When they connect, you write "root@cool-computer# ". When they send bytes, you discard them, then print "root@cool-computer# " again. While obviously accepting a TCP connection and allocating resources on your computer is more risky than just ignoring the connection, presumably it would be fun to do this, which is a good reason for doing something. You can set a memory limit, file descriptor limit, etc. and just crash if they're exceeded. You can run your little fake ssh daemon in gvisor and protect against attacks nobody even knows about yet. All in all, it would be pretty low risk, and also pretty interesting.
- giovannibajo1 6y agohttps://github.com/cowrie/cowrie https://github.com/cowrie/cowrie
- throwawaynothx 6y agohoneypots are obvious.
- rootsudo 6y agoIt depends, many people do not do a full NMAP scan. Takes to much time. Then again, is port knocking security by obscurity enough?
- just-juan-post 6y agoThey won't and that's the point of the OP. "They" are just a bunch of bots that try to hit 22 once and that's it. If it's open report it's open if not then move onto the next target. The only time a human is going to look for SSH on non-22 ports is when they are actively attacking you or your organization.
- nickmooney 6y agoMoving SSH to a non-standard port is helpful only to reduce log noise coming from untargeted attacks. If an attacker is looking at your system, your attack surface is the same no matter where your SSH daemon is bound. I don't think it's worthy any extra effort to "distract" attackers like this.
- warrenm 6y agoSometimes I run an extra http listener on 22