3 ms·

As with most things, I would say that it depends on the use-case. For example, this image might be good for someone who wants to host an internet facing servic

As with most things, I would say that it depends on the use-case. For example, this image might be good for someone who wants to host an internet facing service but only for a few friends, for example a some sort of git forge.

kenniskrag 6y ago
or if they pay the network usage.
SahAssar 6y ago
Why wouldn't you use normal auth for that? or client certificates if you don't want to handle passwords/SSO? How does blocking user-agents, countries, TOR or proxies help with hosting a git forge for a few friends?
- jve 6y ago
  Prevent 99,9+% of bots attacking with random vulnerabilities or brute forcing your private web software? I see it as a defense-in-depth mechanism.
  - SahAssar 6y ago
    If your software can be successfully hacked by "random vulnerabilities" or your passwords can be that easily brute-forced then it's not going to help anyway, and if they can't then I don't think you should care that someone failed a login.
- sbarre 6y ago
  I have a Digital Ocean droplet that I use to host personal sites and projects. I've had it for 3-4 years now. Every morning I get an email from logwatch showing me activity on the server, particularly failed http requests and "attempts to use known hacks" (which are just pattern matches on URL requests). I used to get hundreds of lines of logs PER DAY of this stuff.. Then about a year ago I found a list of IP subnets for China and Russia, and blocked all of it at the OS level with the firewall, and now I get almost nothing in my logs anymore (every so often I add a new subnet to the blocklist, usually from eastern Europe). I can't see any reason why my server that hosts personal stuff would need to see traffic from those countries (and I'm fine with blocking false positives - YMMV). I know it's not a foolproof security measure and if anyone was specifically targeting me this would not stop them, but it helps with all the drive-by scanning. There is a TON of automated scan traffic coming out of China and Russia specifically that is constantly scanning IP blocks known to belong to hosting providers.
  - SahAssar 6y ago
    But why do you care about failed login attempts? If your passwords/keys are good enough and you keep your software updated why care about failed logins?
    - sbarre 6y ago
      You misunderstand, these are not failed logins. These are web scanners trying to find common vulnerabilities in typical web software (phpMyAdmin, Wordpress, Rails, etc). But also potentially exploits in nginx or other parts of the stack for all I know. And they send requests by the hundreds, which pollutes my logs and my logwatch emails. I have automatic security updates turned on for my server, but it's not my full-time job to manage it, so I want to maximize the return on the time I do spend managing it. And since there is zero value/reason in allowing access to my server by anyone in those countries, why not just block it all and have one less thing to worry about, since 99% of that automated traffic comes from there?

kenniskrag 6y ago

or if they pay the network usage.

SahAssar 6y ago

Why wouldn't you use normal auth for that? or client certificates if you don't want to handle passwords/SSO? How does blocking user-agents, countries, TOR or proxies help with hosting a git forge for a few friends?

jve 6y ago
Prevent 99,9+% of bots attacking with random vulnerabilities or brute forcing your private web software? I see it as a defense-in-depth mechanism.
- SahAssar 6y ago
  If your software can be successfully hacked by "random vulnerabilities" or your passwords can be that easily brute-forced then it's not going to help anyway, and if they can't then I don't think you should care that someone failed a login.
sbarre 6y ago
I have a Digital Ocean droplet that I use to host personal sites and projects. I've had it for 3-4 years now. Every morning I get an email from logwatch showing me activity on the server, particularly failed http requests and "attempts to use known hacks" (which are just pattern matches on URL requests). I used to get hundreds of lines of logs PER DAY of this stuff.. Then about a year ago I found a list of IP subnets for China and Russia, and blocked all of it at the OS level with the firewall, and now I get almost nothing in my logs anymore (every so often I add a new subnet to the blocklist, usually from eastern Europe). I can't see any reason why my server that hosts personal stuff would need to see traffic from those countries (and I'm fine with blocking false positives - YMMV). I know it's not a foolproof security measure and if anyone was specifically targeting me this would not stop them, but it helps with all the drive-by scanning. There is a TON of automated scan traffic coming out of China and Russia specifically that is constantly scanning IP blocks known to belong to hosting providers.
- SahAssar 6y ago
  But why do you care about failed login attempts? If your passwords/keys are good enough and you keep your software updated why care about failed logins?
  - sbarre 6y ago
    You misunderstand, these are not failed logins. These are web scanners trying to find common vulnerabilities in typical web software (phpMyAdmin, Wordpress, Rails, etc). But also potentially exploits in nginx or other parts of the stack for all I know. And they send requests by the hundreds, which pollutes my logs and my logwatch emails. I have automatic security updates turned on for my server, but it's not my full-time job to manage it, so I want to maximize the return on the time I do spend managing it. And since there is zero value/reason in allowing access to my server by anyone in those countries, why not just block it all and have one less thing to worry about, since 99% of that automated traffic comes from there?