7 ms·

> Block TOR, proxies, bad user-agents, countries Does this really help? Especially blocking TOR and whole countries seems bad. As for blocking user-agents: why

> Block TOR, proxies, bad user-agents, countries Does this really help? Especially blocking TOR and whole countries seems bad. As for blocking user-agents: why? Sorta seems like when cisco "fixed" a vuln by blocking the curl user agent.

djeiasbsbo 6y ago
As with most things, I would say that it depends on the use-case. For example, this image might be good for someone who wants to host an internet facing service but only for a few friends, for example a some sort of git forge.
- kenniskrag 6y ago
  or if they pay the network usage.
- SahAssar 6y ago
  Why wouldn't you use normal auth for that? or client certificates if you don't want to handle passwords/SSO? How does blocking user-agents, countries, TOR or proxies help with hosting a git forge for a few friends?
  - jve 6y ago
    Prevent 99,9+% of bots attacking with random vulnerabilities or brute forcing your private web software? I see it as a defense-in-depth mechanism.
    - SahAssar 6y ago
      If your software can be successfully hacked by "random vulnerabilities" or your passwords can be that easily brute-forced then it's not going to help anyway, and if they can't then I don't think you should care that someone failed a login.
  - sbarre 6y ago
    I have a Digital Ocean droplet that I use to host personal sites and projects. I've had it for 3-4 years now. Every morning I get an email from logwatch showing me activity on the server, particularly failed http requests and "attempts to use known hacks" (which are just pattern matches on URL requests). I used to get hundreds of lines of logs PER DAY of this stuff.. Then about a year ago I found a list of IP subnets for China and Russia, and blocked all of it at the OS level with the firewall, and now I get almost nothing in my logs anymore (every so often I add a new subnet to the blocklist, usually from eastern Europe). I can't see any reason why my server that hosts personal stuff would need to see traffic from those countries (and I'm fine with blocking false positives - YMMV). I know it's not a foolproof security measure and if anyone was specifically targeting me this would not stop them, but it helps with all the drive-by scanning. There is a TON of automated scan traffic coming out of China and Russia specifically that is constantly scanning IP blocks known to belong to hosting providers.
    - SahAssar 6y ago
      But why do you care about failed login attempts? If your passwords/keys are good enough and you keep your software updated why care about failed logins?
      - sbarre 6y ago
        You misunderstand, these are not failed logins. These are web scanners trying to find common vulnerabilities in typical web software (phpMyAdmin, Wordpress, Rails, etc). But also potentially exploits in nginx or other parts of the stack for all I know. And they send requests by the hundreds, which pollutes my logs and my logwatch emails. I have automatic security updates turned on for my server, but it's not my full-time job to manage it, so I want to maximize the return on the time I do spend managing it. And since there is zero value/reason in allowing access to my server by anyone in those countries, why not just block it all and have one less thing to worry about, since 99% of that automated traffic comes from there?
varispeed 6y ago
What other ways of blocking users do you know? Imagine you have a website with your local town adverts and spammers manually keep registering to your side, confirm email and then keep account appearing to be used by a true user and suddenly start spamming. You block one account, find a couple similar then block them too. Then you get a complain from a user claiming to own one of those accounts. Let's say you ignore that. Few days later a new spam account "wakes up". You block couple similar accounts. Tell spam detector to block certain sentences and domains. Another complaint. Then another account "wake up", this time spam filter catches it, then spammer tries manually changing their spam until it goes through. You block those too and delete accounts. More complaints. Now other legitimate user complain that they cannot share a link or write certain sentences. Turns out spam filter is too trigger happy. You spend time to tune it. More accounts "wake up". This goes on and on. You find yourself no longer working on the site, but firefighting spam. You report the IP addresses used for spam. Nothing changes. Then you find out the IPs are from a couple of countries, that are not your town. You block the IPs. You get complain legitimate user on holiday can't access it. More accounts "wake up" - from new IP addresses. It is TOR. You block TOR. More complaints that some users cannot access, but other than that no more complaints about spam. Finally you can go back to developing your product. It is simply not worth. I advice to block everything from various lists as the minimum. Countries don't allow people from dodgy places, websites should be able to do too. People should be going to jail for spam. They damage economy. Big companies have resources to deal with it so they don't lobby to make law changes as it takes potential competition at bay.
- phil21 6y ago
  > You block TOR. More complaints that some users cannot access, but other than that no more complaints about spam. Sure, if this worked. But it's not 2010 any more. Simple stuff like this only stops the most technologically illiterate attacks. If your site is being attacked by more than bubba the local "computer guy" - they will be using proxies indistinguishable from your normal traffic, assuming you do any volume at all. It's just a silly exercise in futility. I put it up there with moving sshd from port 22 to a random port. Yeah, you get less spam I suppose, but it sure as hell didn't make you any more secure. Probably the opposite. Outright blocks of "bad IPs" are not that useful in my opinion. However, developing reputation systems around IPs and using "is tor" as one metric certainly has shown it's uses in my field of work.

djeiasbsbo 6y ago

As with most things, I would say that it depends on the use-case. For example, this image might be good for someone who wants to host an internet facing service but only for a few friends, for example a some sort of git forge.

kenniskrag 6y ago
or if they pay the network usage.
SahAssar 6y ago
Why wouldn't you use normal auth for that? or client certificates if you don't want to handle passwords/SSO? How does blocking user-agents, countries, TOR or proxies help with hosting a git forge for a few friends?
- jve 6y ago
  Prevent 99,9+% of bots attacking with random vulnerabilities or brute forcing your private web software? I see it as a defense-in-depth mechanism.
  - SahAssar 6y ago
    If your software can be successfully hacked by "random vulnerabilities" or your passwords can be that easily brute-forced then it's not going to help anyway, and if they can't then I don't think you should care that someone failed a login.
- sbarre 6y ago
  I have a Digital Ocean droplet that I use to host personal sites and projects. I've had it for 3-4 years now. Every morning I get an email from logwatch showing me activity on the server, particularly failed http requests and "attempts to use known hacks" (which are just pattern matches on URL requests). I used to get hundreds of lines of logs PER DAY of this stuff.. Then about a year ago I found a list of IP subnets for China and Russia, and blocked all of it at the OS level with the firewall, and now I get almost nothing in my logs anymore (every so often I add a new subnet to the blocklist, usually from eastern Europe). I can't see any reason why my server that hosts personal stuff would need to see traffic from those countries (and I'm fine with blocking false positives - YMMV). I know it's not a foolproof security measure and if anyone was specifically targeting me this would not stop them, but it helps with all the drive-by scanning. There is a TON of automated scan traffic coming out of China and Russia specifically that is constantly scanning IP blocks known to belong to hosting providers.
  - SahAssar 6y ago
    But why do you care about failed login attempts? If your passwords/keys are good enough and you keep your software updated why care about failed logins?
    - sbarre 6y ago
      You misunderstand, these are not failed logins. These are web scanners trying to find common vulnerabilities in typical web software (phpMyAdmin, Wordpress, Rails, etc). But also potentially exploits in nginx or other parts of the stack for all I know. And they send requests by the hundreds, which pollutes my logs and my logwatch emails. I have automatic security updates turned on for my server, but it's not my full-time job to manage it, so I want to maximize the return on the time I do spend managing it. And since there is zero value/reason in allowing access to my server by anyone in those countries, why not just block it all and have one less thing to worry about, since 99% of that automated traffic comes from there?

varispeed 6y ago

What other ways of blocking users do you know? Imagine you have a website with your local town adverts and spammers manually keep registering to your side, confirm email and then keep account appearing to be used by a true user and suddenly start spamming. You block one account, find a couple similar then block them too. Then you get a complain from a user claiming to own one of those accounts. Let's say you ignore that. Few days later a new spam account "wakes up". You block couple similar accounts. Tell spam detector to block certain sentences and domains. Another complaint. Then another account "wake up", this time spam filter catches it, then spammer tries manually changing their spam until it goes through. You block those too and delete accounts. More complaints. Now other legitimate user complain that they cannot share a link or write certain sentences. Turns out spam filter is too trigger happy. You spend time to tune it. More accounts "wake up". This goes on and on. You find yourself no longer working on the site, but firefighting spam. You report the IP addresses used for spam. Nothing changes. Then you find out the IPs are from a couple of countries, that are not your town. You block the IPs. You get complain legitimate user on holiday can't access it. More accounts "wake up" - from new IP addresses. It is TOR. You block TOR. More complaints that some users cannot access, but other than that no more complaints about spam. Finally you can go back to developing your product. It is simply not worth. I advice to block everything from various lists as the minimum. Countries don't allow people from dodgy places, websites should be able to do too. People should be going to jail for spam. They damage economy. Big companies have resources to deal with it so they don't lobby to make law changes as it takes potential competition at bay.

phil21 6y ago
> You block TOR. More complaints that some users cannot access, but other than that no more complaints about spam. Sure, if this worked. But it's not 2010 any more. Simple stuff like this only stops the most technologically illiterate attacks. If your site is being attacked by more than bubba the local "computer guy" - they will be using proxies indistinguishable from your normal traffic, assuming you do any volume at all. It's just a silly exercise in futility. I put it up there with moving sshd from port 22 to a random port. Yeah, you get less spam I suppose, but it sure as hell didn't make you any more secure. Probably the opposite. Outright blocks of "bad IPs" are not that useful in my opinion. However, developing reputation systems around IPs and using "is tor" as one metric certainly has shown it's uses in my field of work.