3 ms·
That last bit is no joke. I got tired of getting ssh probed so I engineered an ssh server that could kill the client with its response (takes a bit of fuzzing a
by ChuckMcM 6y ago
That last bit is no joke. I got tired of getting ssh probed so I engineered an ssh server that could kill the client with its response (takes a bit of fuzzing and a lot of requests but they all use the same code so once it works it works well). For about a week it was hilarious to watch what used to be 5 to 15 hits on the server with various account and password combinations turn into exactly one request from an IP and then nothing. What's more, when IPs would come back again and again for another shot, with my ssh client killer that stopped to. I hoped it was because the error was alerting the owner of the machine that something was amiss and they were taking steps to correct it.
Needless to say, the script kiddies were not happy. Not happy at all. I think my poor old DSL line was dead for a week, got AT&T to give me a different address block and they said they were black holing "hundreds of gigabites" (which at the time was a lot) of spurious packets. Now I just use fail2ban and ignore them, doesn't help their other victims but it keeps me off their radar.
Running the server on AWS hosts might be an interesting alternative.