3 ms·
This is probably Cloudflare Workers? I don't think that demanding that every ISP inspect and censor outgoing packets is ever going to work. Every network oper
by jrockway 5y ago
This is probably Cloudflare Workers?
I don't think that demanding that every ISP inspect and censor outgoing packets is ever going to work. Every network operator has their own definition of good and bad, and it's probably up to that operator to enforce it themselves. Regarding SSH, you can basically assume that 4.2 billion IPs will concurrently try every password database that exists against your server 24/7. Passwords are a failed experiment. People can't remember them, and attackers can easily guess them. The solution is: don't accept password logins, and ban particular IPs after a certain number of failed attempts. (You should do the same for any unauthenticated resource -- if someone gets 1000 pages from your website in a second, you should probably cut off access to them for a while. Some script has gone awry, and it's costing you money, not the author of the script.)
The topics that HN discusses can show you the breadth of opinions on this issue. One day it's "I hate cloud provider X for blocking my abusive service" with 3000 comments agreeing. The next day it's "I hate cloud provider Y for not blocking someone's abusive service" with a different 3000 commeters agreeing. No consensus will ever be reached, and there is no Internet police force you can bully into agreeing with you. I would just take precautions and move on, rather than appealing to a mob or administrative body for some meaningless justice.
- jimsi 5y agoProbably yes, but hey! Why do Cloudflare Worker would need SSH connection establishment? I do not asking Cloudflare to block 22/tcp entirely, but all this situation is very odd - I am seeing anomaly, reported abuse to them, but no explanation why this is happening. About password authentication I totally agreeing with you, but this is a bit out of scope of this thread. The only purpose of this article is to know the truth what is really happening. I have never seen such many connections to the SSH even from researchers.
- dapids 5y agoI think you need to spend more time looking at logs and network traffic in general, this is standard. I bet your public home IP will be scanned at least a couple times just today.
- Symbiote 5y agoJudging my my home network, they can probably expect an SSH connection attempt on a home IP about every 5 seconds or so, or 18,000 times a day. For some reason, this is 6× more than a server I have on an university network.
- stefan_ 5y agoPlease name the cloud providers that have a policy of allowing malicious actors to do SSH scans? Do you mean Cloudflare?
- judge2020 5y agoLet me know if you get banned for doing nmap -p 22 on AWS or GCP.
- dleslie 5y agoThey used to block port scanning, back in 2015: > When unauthorized port scanning is detected by AWS, it is stopped and blocked. Page 13 https://web.archive.org/web/20160331233541/https://d0.awsstatic.com/whitepapers/Security/AWS_Security_Whitepaper.pdf https://web.archive.org/web/20160331233541/https://d0.awssta... It's not clear, now.