17 ms·

Who's Attacking My Server?

212 points by Pseudomanifold 5y ago

zelon88 5y ago
Geo fence them. There is no ROI to providing value to Russia or their partners. They only serve as launchpads for cyber attacks and recon anyway. Chances are any organic Russian would be forbidden from directly viewing your page anyway, so it's literally all bots. Organic Russians come from proxys and VPNs. Russia doesn't reciprocate knowledge or technology or philosophy or anything with value. Primary Russian digital exports are bullet proof hosting, botnet-for-hire services, and low quality malware. Click spam, domain squatting... it's basically the red light district of the internet.
- Topolomancer 5y ago
  Good point; there used to be some issues with this since my dad is an interpreter for Russian, so we used to have some legitimate business there (probably not relevant, but his clients would essentially come to Europe to be trained in certain medical equipment)...but recent events might probably force early retirement for him. Somewhat unrelated: I have noticed that SPAM from Russian servers stopped on Feb 23 right before the invasion; I wonder what that means.
  - mistrial9 5y ago
    does anyone here recognize the difference between civilians and participants in armed conflict? medical in particular, right?
    - LadyCailin 5y ago
      Tell that to the Russians bombing civilian targets in Ukraine. If the worst happening to Russian civilians right now is that they can’t access someone’s blog, well, I can think of far worse things for civilians to have to deal with.
      - InCityDreams 5y ago
        I'm still undecided as to whether closing maccy d's is a good thing or a bad thing (for them).
    - afiori 5y ago
      probably they are talking about how sanctions make making business with Russia difficult.
    - Topolomancer 5y ago
      Couldn't agree more---let me point out that our (i.e. the German) government started sanctions along with the rest of most (all?) European countries. It's not our choice any more---my dad used to believe in the 'Ostpolitik' of Willy Brandt, and he's heartbroken to hear about the horrors of war :( (my research institution has also put a stop on all projects involving Russian collaborators at the moment; on the one hand, I can understand this reaction, on the other hand, it creates even more problems and, as you say, does not distinguish between those responsible for the conflict and those who are not. This is not really not an easy space to navigate.)
    - judge2020 5y ago
      armies are only supported by the industry and economy created by the civilians.
- lmarcos 5y ago
  Any documentation on how to do "geo fencing" without relying on third parties? Is it enough to have one big static list of ip addresses (or subnets)? How often does the list need to be updated?
  - zelon88 5y ago
    I used to do this with a local copy of the IP2Location database [1]. This way you don't have to poll a third party. The caveat is you have to keep the database up to date. https://www.ip2location.com/ https://www.ip2location.com/ [1]
  - uniqueuid 5y ago
    See my recommendation in the top level thread.
  - Spooky23 5y ago
    It depends on what you’re doing and who the legit users are. The downside of static lists is that AWS, Azure, etc frequently purchase IP spaces and realign them with US datacenters. Probably not an issue for blocking Russia or China, but if you want US only traffic, or North American traffic, you can run into problems.
  - chockchocschoir 5y ago
    You cannot know where a server is physically located, as even self-reported locations are incorrect (by accident and/or on purpose) and there is no such thing as non-3rd party data about physical location as servers as again, it's self-reported and any registry can say whatever they want in regards to where a server is located. There are many different 3rd party sources for geo locating IP addresses, maybe MaxMinds is the most popular one. But if you acquire a few, you'll notice that sometimes even they don't agree where the location of a server is.
    - nazgulsenpai 5y ago
      I'm reminded of this story[0] from a few years ago where a family in Kansas was raided by every US ABC agency because MaxMinds was using their lat/long as the default when there was no exact position. https://www.theguardian.com/technology/2016/aug/09/maxmind-mapping-lawsuit-kansas-farm-ip-address https://www.theguardian.com/technology/2016/aug/09/maxmind-m...
- superkuh 5y ago
  Sure. But if you read the article you see the vast majority of the attacks and the most persistent ones seem to originate from China and Hong Kong.
  - duxup 5y ago
    It’s pretty common to geofence China too in my experience, for the same reasons. It seems like malicious traffic would be more agile come from everywhere, but if you block those two countries you filter a great deal of it.
    - deleted 5y ago
      [deleted]
  - hatware 5y ago
    I thought that was so funny. The author even stated at the beginning that the Ukraine/Russia conflict was a reason for better security.
    - cxf12 5y ago
      Russia represented a whopping 2% of his naughty list.
      - Topolomancer 5y ago
        (Posted this above as well) I saw a spike in traffic after the invasion; this prompted the whole thing. Turns out it's not coming from Russia, though.
    - Topolomancer 5y ago
      Yes, because I saw a spike in traffic that made me scratch my head. Turns out it's not originating from there, though :-)
- naoqj 5y ago
  >Organic Russians come from proxys and VPNs. [citation needed] - I have Russian friends and they generally don't use proxies or VPNs.
  - justsomehnguy 5y ago
    With a recent Instagram block I assume you will see much more ordinary people using VPNs.
- jotm 5y ago
  I hate Russia right now, but geofencing is just... bad. I've been geofenced and blocked my whole life, being from a small country no one gives a shit about. If not for the Internet, I'd likely be way more influenced by general media and be a pro-Russian usefu...less idiot. Because there would be no alternative, no way to learn and decide for myself. So just my opinion, every person who can be influenced by western ideals (yes, I'm aware they're far from perfect) is worth it. Perhaps one of them can become someone of influence, either at home or as an immigrant. Am I worth it? No. I don't add much to anything. But neither do the vast majority of Americans and Europeans. I'd just rather have a Russian/Chinese/Pakistani/Iranian/you name it as a friend than as an enemy. If the price is learning proper configuration and/or a single core MIPS processor working overtime, I'd say it's worth it.
tptacek 5y ago
Fail2ban is theater on a properly configured server --- and, increasingly since the mid 2010's, you've had to go out of your way to have a badly configured SSH server. Either way, it's something you have to add specifically to your server, so if you're going to do that, use the same energy to just make sure your server is configured properly. Yeah, yeah, I know it "keeps your logs clean". So does grep, though.
- Topolomancer 5y ago
  Thanks, I was unaware of this---I initially (naively?) thought that being banned would at least deter some wannabe attackers. In your experience, does it do anything if I start collecting some reports on repeat offenders and notify their ISP? Or is that just more wishful thinking of my part?
  - tptacek 5y ago
    Absolutely nothing will be done about reports of people running SSH scanners against your host; it would be like Cnut on his seashore throne ruling the waves to recede: even in the unlikely event that a hosting provider shut someone off (we probably would, if you told us), they'd be followed by 10,000 more.
    - Topolomancer 5y ago
      Thanks for the reality check, I appreciate it! At least I got a nice map out of this (and made sure that nothing was configured incorrectly, to the best of my knowledge)...
      - bombcar 5y ago
        You can get a similar reduction in ssh scans simply by moving the port (and doing nothing else) as the majority of scans only hit port 22. Whether this is worth the hassle is left to the reader: if you have passwords disabled and only use keys it really shouldn’t matter.
37ef_ced3 5y ago
Anecdotally, I run a several servers hosting several websites and several Android app back-ends. Every few weeks they are attacked: 12 hours of attempted logins, port scanning, etc. It's perfectly normal and nothing new.
- nerdyadventurer 5y ago
  What are best practices to secure back-end services, websites? Any good resources on the topic
cm2187 5y ago
I do a similar monitoring on my personal servers which shouldn’t be of interest to anyone really. Interestingly I don’t think I have ever seen anyone trying to login on any protocol using IPv6. Which is why it is most likely bots scanning the whole ipv4 address space rather than targeting those servers.
- cube00 5y ago
  I'm keen to see where this goes as we move to IPv6 only services. The claim now is IPv6 is too large to scan but maybe they're not bothering because most IPv6 servers also listen on IPv4. Once they move to IPv6 only (after I need to sell my house to afford a single IPv4 address) it might be worth the extra scan time.
  - cm2187 5y ago
    The extra scan time? You certainly can't possibly physically scan the whole 128bit address space. I am not even sure you can if you know which /48 prefixes have been assigned.
  - chockchocschoir 5y ago
    While IPv4 in it's entirely is trivial to scan (could do it in ~5 minutes more or less with the right hardware), usually you'd go for ranges to scan instead of the entire space, and IPv6 will still be feasible to scan for ranges, although they become larger.
    - jandrese 5y ago
      I disagree that IPv6 will be feasible to scan except in unusual circumstances. There might be a case for scanning all of the low ranges ::1 through ::16 or so in the low 2001:: range, but even then you're searching for a rare needle in a haystack. Mass scans become quite impractical.
      - chockchocschoir 5y ago
        Usually you perform scans with highly defined IP blocks (at least when you have a target in mind) that are announced by the organizations themselves. Since the ranges are announced publicly, you already have them. Since you have a target in mind, you already have at least one IP. Now take a range that includes that target, and you have a block that has at least one host inside of it. Use masscan that can do 10 million packets/second (with just one machine) and I'm pretty sure you can feasibly scan IPv6 blocks as well, you just have to get better at targeting and not just wildly target "0.0.0.0/8" (but the IPv6 equivalent). Moreover, you can scan for one common port inside a block (like 22, 80, 443 or whatever) which means you can cover wider blocks, and for the hosts you find, run a scan covering a bigger range of ports. Again, improve the targeting and IPv6 won't stop you either.
uniqueuid 5y ago
This is a good opportunity to recommend nft blackhole [1]. Automatically block countries by CIDR blocks and known bad actor IPs. Auto-updates these lists and adds them to your firewall. It's a 5 minute install and maintenance free afterwards. Not perfect, but reduces attack surface and log spam. [1] https://github.com/tomasz-c/nft-blackhole https://github.com/tomasz-c/nft-blackhole
- chockchocschoir 5y ago
  Looks not-so reliable. Either fetches a list of blocks from https://github.com/herrbischoff/country-ip-blocks https://github.com/herrbischoff/country-ip-blocks which is a random GitHub repository that collects "straight from the Regional Internet Registries" without any stating any sources nor method for gathering it (which also, I'm assuming, is self-reported data from those registries), or it fetches it from https://www.ipdeny.com/ https://www.ipdeny.com/ which currently runs with an expired TLS certificate, which on top of everything, nft-blackhole ignores any issues with certificates anyways, leaving it wide open to MITM attacks (https://github.com/tomasz-c/nft-blackhole/blob/8a656ac0a803ad134bc1d4689503a1ef7d052442/nft-blackhole.py#L83-L87 https://github.com/tomasz-c/nft-blackhole/blob/8a656ac0a803a...) I wouldn't run that if I'd want something to reliably block someone from a specific country. > Not perfect, but reduces attack surface and log spam. You know what also does that? Setting up sshd properly in the first place.
  - throwmeariver1 5y ago
    Calling the repository of Marcel Bischoff a random GitHub repository. LOL
    - chockchocschoir 5y ago
      Yes, GitHub repositories are generally not considered trust-worthy sources of information unless you actually could cite your resources in the repository itself. This information gathered there has 1) no source stated and 2) no way of reproducing the information yourself, earning it the description of "A Random GitHub Repository", even when you try to appeal to authority.
ValtteriL 5y ago
"I am wondering whether it would be legal to try to automatically check for known exploits, in order to ‘p0wn’ the wannabe-attacker and disable their system instead." Absolutely illegal. Don't do that. Also, if your setup is enough at controlling the nuisance, why bother? -- Good work though, liked the visualization of attacker IP locations! Have you considered running at least SSH on nonstandard port?
- ganzuul 5y ago
  What about hold your ground laws, or self defense? It may be time to consider these.
  - LinuxBender 5y ago
    Those are generally for humans defending themselves in life threatening situations. I would suggest talking to a lawyer if you are going this route.
    - ganzuul 5y ago
      I'm not. I wish to consider if defending one's home might include defending one's electronic presence, however that may manifest itself. For example, you have a home security system that you monitor from your mobile device. Perhaps you have your pet at home, there have been break-ins in your neighborhood, and just after someone showed up on your doorstep the CCTV feed cuts. You are not at home and the cops are busy. - But you have the skills to defend your home's electronic presence. You suspect a life, your pet, may be in danger so you have a good motive. What then?
      - przemub 5y ago
        That's more of a question if protecting your pet's life constitutes a necessary defence in your jurisdiction.
      - LinuxBender 5y ago
        I totally get the idea and I agree with the intent. There are some places that allow defending a home using automation using non lethal force but even that comes with some risk of civil legal issues. This is why I suggest consulting with a lawyer. Even with non lethal means one would want to ensure it is legal in their location and that they have the proper signs with appropriate verbiage and mitigating controls in place first. Also understanding what laws are enforced and how they are enforced in your particular area is useful. My own personal solution was to move to a location that supports your idea and the Sheriff would likely high-five me if I take out the trash. There are trade-offs of course and hopefully such things are never required. There was talk at one point of creating laws that supported counter-hacking but those never happened and it is highly unlikely they would ever pass. Proper attribution is hard enough. There are endless rabbit holes of problems such laws would create. At a minimum there would be a vastly increased requirement on everyone's part to increase audit trails and data storage alone would become a booming business, far more than it already is.
logifail 5y ago
> "failed login attempts" At least with SSH, once you move to only using key-based authentication, don't you simply stop worrying about weak passwords and failed logins? You can then focus on keeping up to date with security patches, which is at least as important, but takes far less time.
- cube00 5y ago
  It's still noise in the log you can do without if you really want to know what's going on with your system. For me I firewall ssh to only accept from known IPs. Worst case if I have to expand that list I'll login via the VPS provider's console to do that.
  - logifail 5y ago
    Hmm, there's noise, and there's noise. If you know that password auth is disabled, don't you just grep out all the disconnected/preauth and 'invalid user' lines before you even look at (or process) auth.log? On a box where password auth is enabled, you can't be sure what's signal and what's noise.
    - cube00 5y ago
      I guess I'm also worried about an SSH zero day hitting that I could avoid if I firewall filter the source IPs. I offer other services on the public internet so a zero day could hit them but I don't have a choice in those cases (eg. incoming mail on 25), however with SSH I don't need to offer it to the world so why take the risk in the first place?
- vdfs 5y ago
  Also changing the default port. weird these two simple options are not used. They won't stop those automated attempts from appearing in your logs, but will greatly decrease them
cplex 5y ago
Also with https://www.greynoise.io/ https://www.greynoise.io/ api you can determine if these IPs are scanning the internet or targeting you specifically.
- Pseudomanifold 5y ago
  Wow, did not know that this existed. Thanks so much!
- klausagnoletti 5y ago
  Same thing is possible using https://app.crowdsec.net/ https://app.crowdsec.net/ (just create a free user account and use the search feature) - and if you install the accompanying agent, those bad actors already known will be blocked automatically (just as those that attack you will be shared to all other users). This is collaboration that makes sense!
Terry_Roll 5y ago
> Who's Attacking My Server? Probably the security services and some useful idiots who fall for the propaganda pumped out through the media. Its divide and conquer, been going on since the The Holy Roman Empire, and it doesnt take much to hack switches or have agents in foreign countries so the geolocating attacks is worthless, its just something to mess with your mind. Its keeps people busy though as you have found out!
mimimi31 5y ago
I once made a very similar visualization to see where people were trying to attack my servers from by adapting (e.g. use local geoip database file instead of ipinfo service) the Python script from [1], which uses folium to generate an interactive (standalone HTML file) heatmap of IP address locations. [1] https://github.com/meesaltena/SSHHeatmap https://github.com/meesaltena/SSHHeatmap
- Topolomancer 5y ago
  That looks gorgeous, thanks for sharing it!
- heap_perms 5y ago
  That's a wonderful project. Amazing, this can be done with just over a hundred lines of code. (excluding packages)
- snek_case 5y ago
  I'm curious what would happen if someone set up a sandbox and let the attackers in. As in curious what commands they would run and what services they would try to install. I'm guessing crypto mining or spam mail?
  - dspillett 5y ago
    The problem with a honey trap like that is that the uninteresting events are uninteresting (as you suggest, installing a mail relay, miner, or both, and likely a copy of itself for further spreading), but the interesting ones are unlikely to be fooled unless the honeypot is very clever. To see anything really interesting you possibly need to let it get far enough that with a good zero-day intend in-hand it may be able to break out and affect the host. I don't know about you, but I don't trust myself to be that clever!
DethNinja 5y ago
Change the default ssh port. Most of the attacks are from automated crawlers that try to brute force port 22. Your logs will become much more manageable.
- daneel_w 5y ago
  I do the same. There's no need at all for my own system's sshd to adhere to any notion of well known ports. Despite the growing availability of pre-mapped host information I can still count the amount of illicit login attempts the past 10 years on two hands.
speedgoose 5y ago
I put SSH on another port and only allow a list of ip ranges on the firewall. I don’t see the point of even allowing Russia and China to fill my logs.
Sami_Lehtinen 5y ago
My servers currently ban in average 1200 individual addresses and around 20 /24 cidr network addresses, which is triggered after N individual addresses in a specific subnet size gets flagged. The amount of abuse traffic is ridiculous.
fuzzy2 5y ago
I just ban China entirely from accessing my server. There's nothing on it a Chinese person could be interested in, just personal stuff and a private forum. Doing so has tremendously reduced the overall (remaining) abuse traffic volume. It's quite easy and efficient to do this using IPSet. IP ranges associated with China are available on the net.
- chockchocschoir 5y ago
  Before going about a blocking potential people who are in fact interested in your content/service (which you can't know if they are or not based on the country), did you do the bare minimum to secure your server against attackers from any other location, namely changed from the default password and disabled password login? Your approach to security has a number of issues. First, you don't know if someone is actually interested in your thing or not based on the location. They could be visiting China, could still be able to speak English or any other reason. Secondly, the mapping of Location <> IP Address is not as guaranteed as you seem to think. Plenty of IPs get flagged as Chinese while not being in China, and vice-versa is true as well. Just because some 3rd party says a host/client is in a specific location doesn't make that true. Edit: Seems the commentator I replied to now have added "just personal stuff and a private forum" to their comment which was not there before, so most of my point is moot now, as I assumed at least semi-public content/service, not private.
  - criddell 5y ago
    I don't think it matters if the geo-location table is correct or not. If traffic from an IP range is entirely malicious, block that IP range. If that range happens to be Chinese or from Florida it doesn't really matter, does it?
    - chockchocschoir 5y ago
      Correct, blocking a IP block based on that malicious traffic comes from there might be a worthwhile strategy (although I'd argue that it's less important than properly configuring your stuff anyways, getting a new IP is trivial), and also a strategy which is different than what fuzzy2 was describing, which is what I was arguing against.
unixhero 5y ago
There is also crowdsec that promises fail2ban functionality from a crowdsourced data feed. https://crowdsec.net/ https://crowdsec.net/
tiku 5y ago
I'm still thinking about adding some Chinese forbidden texts to my headers to block them using their own firewall. Recently Russian IPS started to attack me as well, so perhaps adding something about the war would help block them as well? Any ideas from you guys?
- belter 5y ago
  https://en.wikipedia.org/wiki/Winnie-the-Pooh https://en.wikipedia.org/wiki/Winnie-the-Pooh
butz 5y ago
I'd assume that most attacks are coming not from attackers directly, but from some sort of hacked devices in some other country, either webcam with root access or similar, maybe even proxy servers. Would be interesting to match malicious IP addresses with ones indexed by shodan to test this theory.
hutch120 5y ago
I see these articles a lot, and always wonder why people go it alone. Can anyone link to a discussion about a distributed community run firewall? Does such a thing exist? If so, please comment.
- wila 5y ago
  Don't know about "community run firewall", but if you have a few hosts then you can run CSF/LFD in a cluster config. See for example: https://www.nixtree.com/blog/csf-cluster-setup-for-hosting-companies/ https://www.nixtree.com/blog/csf-cluster-setup-for-hosting-c...
- klausagnoletti 5y ago
  I don't know exaxtly what you mean by a distributed community run firewall but https://crowdsec.net/ https://crowdsec.net/ collects information (anonymously) on the attacks users see and shares it with all other users after vetting them. So in this way the community helps itself (or each other, if you will). Currently around 800k signals are collected daily and around 19k ips are shared back to users as blocklists.
YATA0 5y ago
Port knocking, Wireguard, never look back. You can set an alert for every failed SSH connection because if someone is able to get through that, it's alarming. This setup has the side effect of reducing your log noise to zero. That SNR is super important for intrusion detection.
- elesiuta 5y ago
  I found just using a different port was enough for me and didn't need port knocking to reduce log noise, which I agree is super important. I also have alerts for both failed SSH or failed wireguard connections, and for any logins from a new IP with either SSH or wireguard.
- pseudostem 5y ago
  The folks at OpenBSD Misc do not recommend port knocking. IIRC one of the reasons stated was a possibility of getting locked out of your own server. I tried looking up the relevant thread, but am on the phone.
  - octoberfranklin 5y ago
    Linux's firewall can do port knocking entirely in the kernel: https://wiki.nftables.org/wiki-nftables/index.php/Port_knocking_example https://wiki.nftables.org/wiki-nftables/index.php/Port_knock... That script gets compiled into BPF and uploaded into the kernel once, at boot/ifup time. All the memory is preallocated. Userspace can be dead/hung/OOM and you can be sure that at least the port knocking won't be why you got locked out.
    - pseudostem 5y ago
      Thank you. One learns something new everyday. And I feel humbled by most comments I read here. I did look up OpenBSD pf again, and it too does port knocking in the kernel. My information was dated (left the misc mailing list at least 5 years ago).
- orev 5y ago
  An upgrade to port knocking is Single Packet Authorization [1]. It doesn’t suffer from the observability, and other, problems of port knocking. [1] https://www.cipherdyne.org/fwknop/ https://www.cipherdyne.org/fwknop/
zaik 5y ago
It's also worth noting that if an attacker knows how to spoof your IP address, they can lock you out of your own server.
- jhgg 5y ago
  Yeah? You can't really spoof TCP connections... unless you are talking about doing a BGP hijack. Can you elaborate more on this?
  - zaik 5y ago
    It's just something I read here: https://wiki.archlinux.org/title/Fail2ban#Tips_and_tricks https://wiki.archlinux.org/title/Fail2ban#Tips_and_tricks Maybe we can spoof both SYN and ACK and brute force/be lucky with the sequence numbers?
amelius 5y ago
> As a machine learning researcher, I know that I have different tools at my disposal: I could monitor connections over a prolonged period of time, categorise them as hostile or not, and train a transformer to detect hostile connections in real time. All this would take is a long time for data collection and labelling, followed by a lot of GPU hours. It's not so simple. You typically need balanced data, which is difficult to obtain since the attacks don't happen very often (hopefully). This is also why anomaly detection is so difficult.
prima-facie 5y ago
I used SSHGuard in the past which can actually cover a lot more services than just SSH. I imagine this sort of daemon is useful when you have external customers. It also has a touchy behaviour which gradually increases the timeout until it permanently locks out misbehaving clients. Nowadays I just use WireGuard to access my own LAN. But this doesn't scale as well if you need to constantly add and remove clients from the network. For Nginx most bogus requests come directly on the public IP. So you can set up a dummy/catch-all vhost which drops those. https://pastebin.com/MuWgyGGG https://pastebin.com/MuWgyGGG
- klausagnoletti 5y ago
  https://crowdsec.net/ https://crowdsec.net/ can also do something like that, only more advanced in the attacks it detects and because it's sharing bad ips from users to everyone else. I love that users in this way are watching each other's back.
  - prima-facie 5y ago
    Nice tool, thanks.
jakedata 5y ago
I use fail2ban on a server that is listening on a non-standard port. I monitor the bans on a daily basis. The IPs come from all over the world but when China shut down from Covid the login attempts just _stopped_. Like, the silence was deafening, like I thought the server was compromised and logging disabled. It was spooky as hell, but as things came back to something resembling normal, the background radiation started picking up again and I am back to 60-80 bans per day. I have a hell of a list of compromised IPs now.
- alyandon 5y ago
  I do something similar with firehol lists and iptables/ipfw scripts and it cut my auth log spam down to almost nothing - single digit auth attempts per day per server now usually. My first pass of blocking .cn network space on its own cut my log spam by probably 90% (thousands of attempts per day down to dozens).
kazinator 5y ago
As a machine learning researcher, I know that I have different tools at my disposal: [...] awk '($(NF-1) = /Ban/){print $NF}' /tmp/fail2ban.log \ | sort \ | jdresolve - \ | uniq -c \ | sort -n -r \ | sed -e 's/^[ \t]*//' \ | sed -e 's/ /\t/' \ | head -n 100 :)
- Topolomancer 5y ago
  That's the joke :)
thg 5y ago
I'm surprised nobody has mentioned ssh-audit yet, so here it is: https://pypi.org/project/ssh-audit/ https://pypi.org/project/ssh-audit/ It's useful for helping in hardening the SSH configuration and there is also a web version here: https://www.ssh-audit.com/ https://www.ssh-audit.com/
xyst 5y ago
I am surprised more people don't have honeypot servers. Would be very easy to lure in unsuspecting victims, open up a reverse shell, drop a payload, and extract any assets.
winternett 5y ago
I've even had my search logs attacked by bots submitting spam search terms multiple times in hopes that I run a "popular search terms" page... Thank goodness I don't allow public comments, it seems like the ability to comment on things may be totally gone by 2024 unless we don't address the specific places the spam is really coming from and why instead of just hardening our own local security.

Geo fence them. There is no ROI to providing value to Russia or their partners. They only serve as launchpads for cyber attacks and recon anyway. Chances are any organic Russian would be forbidden from directly viewing your page anyway, so it's literally all bots. Organic Russians come from proxys and VPNs. Russia doesn't reciprocate knowledge or technology or philosophy or anything with value. Primary Russian digital exports are bullet proof hosting, botnet-for-hire services, and low quality malware. Click spam, domain squatting... it's basically the red light district of the internet.

Topolomancer 5y ago
Good point; there used to be some issues with this since my dad is an interpreter for Russian, so we used to have some legitimate business there (probably not relevant, but his clients would essentially come to Europe to be trained in certain medical equipment)...but recent events might probably force early retirement for him. Somewhat unrelated: I have noticed that SPAM from Russian servers stopped on Feb 23 right before the invasion; I wonder what that means.
- mistrial9 5y ago
  does anyone here recognize the difference between civilians and participants in armed conflict? medical in particular, right?
  - LadyCailin 5y ago
    Tell that to the Russians bombing civilian targets in Ukraine. If the worst happening to Russian civilians right now is that they can’t access someone’s blog, well, I can think of far worse things for civilians to have to deal with.
    - InCityDreams 5y ago
      I'm still undecided as to whether closing maccy d's is a good thing or a bad thing (for them).
  - afiori 5y ago
    probably they are talking about how sanctions make making business with Russia difficult.
  - Topolomancer 5y ago
    Couldn't agree more---let me point out that our (i.e. the German) government started sanctions along with the rest of most (all?) European countries. It's not our choice any more---my dad used to believe in the 'Ostpolitik' of Willy Brandt, and he's heartbroken to hear about the horrors of war :( (my research institution has also put a stop on all projects involving Russian collaborators at the moment; on the one hand, I can understand this reaction, on the other hand, it creates even more problems and, as you say, does not distinguish between those responsible for the conflict and those who are not. This is not really not an easy space to navigate.)
  - judge2020 5y ago
    armies are only supported by the industry and economy created by the civilians.
lmarcos 5y ago
Any documentation on how to do "geo fencing" without relying on third parties? Is it enough to have one big static list of ip addresses (or subnets)? How often does the list need to be updated?
- zelon88 5y ago
  I used to do this with a local copy of the IP2Location database [1]. This way you don't have to poll a third party. The caveat is you have to keep the database up to date. https://www.ip2location.com/ https://www.ip2location.com/ [1]
- uniqueuid 5y ago
  See my recommendation in the top level thread.
- Spooky23 5y ago
  It depends on what you’re doing and who the legit users are. The downside of static lists is that AWS, Azure, etc frequently purchase IP spaces and realign them with US datacenters. Probably not an issue for blocking Russia or China, but if you want US only traffic, or North American traffic, you can run into problems.
- chockchocschoir 5y ago
  You cannot know where a server is physically located, as even self-reported locations are incorrect (by accident and/or on purpose) and there is no such thing as non-3rd party data about physical location as servers as again, it's self-reported and any registry can say whatever they want in regards to where a server is located. There are many different 3rd party sources for geo locating IP addresses, maybe MaxMinds is the most popular one. But if you acquire a few, you'll notice that sometimes even they don't agree where the location of a server is.
  - nazgulsenpai 5y ago
    I'm reminded of this story[0] from a few years ago where a family in Kansas was raided by every US ABC agency because MaxMinds was using their lat/long as the default when there was no exact position. https://www.theguardian.com/technology/2016/aug/09/maxmind-mapping-lawsuit-kansas-farm-ip-address https://www.theguardian.com/technology/2016/aug/09/maxmind-m...
superkuh 5y ago
Sure. But if you read the article you see the vast majority of the attacks and the most persistent ones seem to originate from China and Hong Kong.
- duxup 5y ago
  It’s pretty common to geofence China too in my experience, for the same reasons. It seems like malicious traffic would be more agile come from everywhere, but if you block those two countries you filter a great deal of it.
  - deleted 5y ago
    [deleted]
- hatware 5y ago
  I thought that was so funny. The author even stated at the beginning that the Ukraine/Russia conflict was a reason for better security.
  - cxf12 5y ago
    Russia represented a whopping 2% of his naughty list.
    - Topolomancer 5y ago
      (Posted this above as well) I saw a spike in traffic after the invasion; this prompted the whole thing. Turns out it's not coming from Russia, though.
  - Topolomancer 5y ago
    Yes, because I saw a spike in traffic that made me scratch my head. Turns out it's not originating from there, though :-)
naoqj 5y ago
>Organic Russians come from proxys and VPNs. [citation needed] - I have Russian friends and they generally don't use proxies or VPNs.
- justsomehnguy 5y ago
  With a recent Instagram block I assume you will see much more ordinary people using VPNs.
jotm 5y ago
I hate Russia right now, but geofencing is just... bad. I've been geofenced and blocked my whole life, being from a small country no one gives a shit about. If not for the Internet, I'd likely be way more influenced by general media and be a pro-Russian usefu...less idiot. Because there would be no alternative, no way to learn and decide for myself. So just my opinion, every person who can be influenced by western ideals (yes, I'm aware they're far from perfect) is worth it. Perhaps one of them can become someone of influence, either at home or as an immigrant. Am I worth it? No. I don't add much to anything. But neither do the vast majority of Americans and Europeans. I'd just rather have a Russian/Chinese/Pakistani/Iranian/you name it as a friend than as an enemy. If the price is learning proper configuration and/or a single core MIPS processor working overtime, I'd say it's worth it.

tptacek 5y ago

Fail2ban is theater on a properly configured server --- and, increasingly since the mid 2010's, you've had to go out of your way to have a badly configured SSH server. Either way, it's something you have to add specifically to your server, so if you're going to do that, use the same energy to just make sure your server is configured properly. Yeah, yeah, I know it "keeps your logs clean". So does grep, though.

Topolomancer 5y ago
Thanks, I was unaware of this---I initially (naively?) thought that being banned would at least deter some wannabe attackers. In your experience, does it do anything if I start collecting some reports on repeat offenders and notify their ISP? Or is that just more wishful thinking of my part?
- tptacek 5y ago
  Absolutely nothing will be done about reports of people running SSH scanners against your host; it would be like Cnut on his seashore throne ruling the waves to recede: even in the unlikely event that a hosting provider shut someone off (we probably would, if you told us), they'd be followed by 10,000 more.
  - Topolomancer 5y ago
    Thanks for the reality check, I appreciate it! At least I got a nice map out of this (and made sure that nothing was configured incorrectly, to the best of my knowledge)...
    - bombcar 5y ago
      You can get a similar reduction in ssh scans simply by moving the port (and doing nothing else) as the majority of scans only hit port 22. Whether this is worth the hassle is left to the reader: if you have passwords disabled and only use keys it really shouldn’t matter.

37ef_ced3 5y ago

Anecdotally, I run a several servers hosting several websites and several Android app back-ends. Every few weeks they are attacked: 12 hours of attempted logins, port scanning, etc. It's perfectly normal and nothing new.

nerdyadventurer 5y ago
What are best practices to secure back-end services, websites? Any good resources on the topic

cm2187 5y ago

I do a similar monitoring on my personal servers which shouldn’t be of interest to anyone really. Interestingly I don’t think I have ever seen anyone trying to login on any protocol using IPv6. Which is why it is most likely bots scanning the whole ipv4 address space rather than targeting those servers.

cube00 5y ago
I'm keen to see where this goes as we move to IPv6 only services. The claim now is IPv6 is too large to scan but maybe they're not bothering because most IPv6 servers also listen on IPv4. Once they move to IPv6 only (after I need to sell my house to afford a single IPv4 address) it might be worth the extra scan time.
- cm2187 5y ago
  The extra scan time? You certainly can't possibly physically scan the whole 128bit address space. I am not even sure you can if you know which /48 prefixes have been assigned.
- chockchocschoir 5y ago
  While IPv4 in it's entirely is trivial to scan (could do it in ~5 minutes more or less with the right hardware), usually you'd go for ranges to scan instead of the entire space, and IPv6 will still be feasible to scan for ranges, although they become larger.
  - jandrese 5y ago
    I disagree that IPv6 will be feasible to scan except in unusual circumstances. There might be a case for scanning all of the low ranges ::1 through ::16 or so in the low 2001:: range, but even then you're searching for a rare needle in a haystack. Mass scans become quite impractical.
    - chockchocschoir 5y ago
      Usually you perform scans with highly defined IP blocks (at least when you have a target in mind) that are announced by the organizations themselves. Since the ranges are announced publicly, you already have them. Since you have a target in mind, you already have at least one IP. Now take a range that includes that target, and you have a block that has at least one host inside of it. Use masscan that can do 10 million packets/second (with just one machine) and I'm pretty sure you can feasibly scan IPv6 blocks as well, you just have to get better at targeting and not just wildly target "0.0.0.0/8" (but the IPv6 equivalent). Moreover, you can scan for one common port inside a block (like 22, 80, 443 or whatever) which means you can cover wider blocks, and for the hosts you find, run a scan covering a bigger range of ports. Again, improve the targeting and IPv6 won't stop you either.

uniqueuid 5y ago

This is a good opportunity to recommend nft blackhole [1]. Automatically block countries by CIDR blocks and known bad actor IPs. Auto-updates these lists and adds them to your firewall. It's a 5 minute install and maintenance free afterwards. Not perfect, but reduces attack surface and log spam. [1] https://github.com/tomasz-c/nft-blackhole https://github.com/tomasz-c/nft-blackhole

chockchocschoir 5y ago
Looks not-so reliable. Either fetches a list of blocks from https://github.com/herrbischoff/country-ip-blocks https://github.com/herrbischoff/country-ip-blocks which is a random GitHub repository that collects "straight from the Regional Internet Registries" without any stating any sources nor method for gathering it (which also, I'm assuming, is self-reported data from those registries), or it fetches it from https://www.ipdeny.com/ https://www.ipdeny.com/ which currently runs with an expired TLS certificate, which on top of everything, nft-blackhole ignores any issues with certificates anyways, leaving it wide open to MITM attacks (https://github.com/tomasz-c/nft-blackhole/blob/8a656ac0a803ad134bc1d4689503a1ef7d052442/nft-blackhole.py#L83-L87 https://github.com/tomasz-c/nft-blackhole/blob/8a656ac0a803a...) I wouldn't run that if I'd want something to reliably block someone from a specific country. > Not perfect, but reduces attack surface and log spam. You know what also does that? Setting up sshd properly in the first place.
- throwmeariver1 5y ago
  Calling the repository of Marcel Bischoff a random GitHub repository. LOL
  - chockchocschoir 5y ago
    Yes, GitHub repositories are generally not considered trust-worthy sources of information unless you actually could cite your resources in the repository itself. This information gathered there has 1) no source stated and 2) no way of reproducing the information yourself, earning it the description of "A Random GitHub Repository", even when you try to appeal to authority.

ValtteriL 5y ago

"I am wondering whether it would be legal to try to automatically check for known exploits, in order to ‘p0wn’ the wannabe-attacker and disable their system instead." Absolutely illegal. Don't do that. Also, if your setup is enough at controlling the nuisance, why bother? -- Good work though, liked the visualization of attacker IP locations! Have you considered running at least SSH on nonstandard port?

ganzuul 5y ago
What about hold your ground laws, or self defense? It may be time to consider these.
- LinuxBender 5y ago
  Those are generally for humans defending themselves in life threatening situations. I would suggest talking to a lawyer if you are going this route.
  - ganzuul 5y ago
    I'm not. I wish to consider if defending one's home might include defending one's electronic presence, however that may manifest itself. For example, you have a home security system that you monitor from your mobile device. Perhaps you have your pet at home, there have been break-ins in your neighborhood, and just after someone showed up on your doorstep the CCTV feed cuts. You are not at home and the cops are busy. - But you have the skills to defend your home's electronic presence. You suspect a life, your pet, may be in danger so you have a good motive. What then?
    - przemub 5y ago
      That's more of a question if protecting your pet's life constitutes a necessary defence in your jurisdiction.
    - LinuxBender 5y ago
      I totally get the idea and I agree with the intent. There are some places that allow defending a home using automation using non lethal force but even that comes with some risk of civil legal issues. This is why I suggest consulting with a lawyer. Even with non lethal means one would want to ensure it is legal in their location and that they have the proper signs with appropriate verbiage and mitigating controls in place first. Also understanding what laws are enforced and how they are enforced in your particular area is useful. My own personal solution was to move to a location that supports your idea and the Sheriff would likely high-five me if I take out the trash. There are trade-offs of course and hopefully such things are never required. There was talk at one point of creating laws that supported counter-hacking but those never happened and it is highly unlikely they would ever pass. Proper attribution is hard enough. There are endless rabbit holes of problems such laws would create. At a minimum there would be a vastly increased requirement on everyone's part to increase audit trails and data storage alone would become a booming business, far more than it already is.

logifail 5y ago

> "failed login attempts" At least with SSH, once you move to only using key-based authentication, don't you simply stop worrying about weak passwords and failed logins? You can then focus on keeping up to date with security patches, which is at least as important, but takes far less time.

cube00 5y ago
It's still noise in the log you can do without if you really want to know what's going on with your system. For me I firewall ssh to only accept from known IPs. Worst case if I have to expand that list I'll login via the VPS provider's console to do that.
- logifail 5y ago
  Hmm, there's noise, and there's noise. If you know that password auth is disabled, don't you just grep out all the disconnected/preauth and 'invalid user' lines before you even look at (or process) auth.log? On a box where password auth is enabled, you can't be sure what's signal and what's noise.
  - cube00 5y ago
    I guess I'm also worried about an SSH zero day hitting that I could avoid if I firewall filter the source IPs. I offer other services on the public internet so a zero day could hit them but I don't have a choice in those cases (eg. incoming mail on 25), however with SSH I don't need to offer it to the world so why take the risk in the first place?
vdfs 5y ago
Also changing the default port. weird these two simple options are not used. They won't stop those automated attempts from appearing in your logs, but will greatly decrease them

cplex 5y ago

Also with https://www.greynoise.io/ https://www.greynoise.io/ api you can determine if these IPs are scanning the internet or targeting you specifically.

Pseudomanifold 5y ago
Wow, did not know that this existed. Thanks so much!
klausagnoletti 5y ago
Same thing is possible using https://app.crowdsec.net/ https://app.crowdsec.net/ (just create a free user account and use the search feature) - and if you install the accompanying agent, those bad actors already known will be blocked automatically (just as those that attack you will be shared to all other users). This is collaboration that makes sense!

Terry_Roll 5y ago

> Who's Attacking My Server? Probably the security services and some useful idiots who fall for the propaganda pumped out through the media. Its divide and conquer, been going on since the The Holy Roman Empire, and it doesnt take much to hack switches or have agents in foreign countries so the geolocating attacks is worthless, its just something to mess with your mind. Its keeps people busy though as you have found out!

mimimi31 5y ago

I once made a very similar visualization to see where people were trying to attack my servers from by adapting (e.g. use local geoip database file instead of ipinfo service) the Python script from [1], which uses folium to generate an interactive (standalone HTML file) heatmap of IP address locations. [1] https://github.com/meesaltena/SSHHeatmap https://github.com/meesaltena/SSHHeatmap

Topolomancer 5y ago
That looks gorgeous, thanks for sharing it!
heap_perms 5y ago
That's a wonderful project. Amazing, this can be done with just over a hundred lines of code. (excluding packages)
snek_case 5y ago
I'm curious what would happen if someone set up a sandbox and let the attackers in. As in curious what commands they would run and what services they would try to install. I'm guessing crypto mining or spam mail?
- dspillett 5y ago
  The problem with a honey trap like that is that the uninteresting events are uninteresting (as you suggest, installing a mail relay, miner, or both, and likely a copy of itself for further spreading), but the interesting ones are unlikely to be fooled unless the honeypot is very clever. To see anything really interesting you possibly need to let it get far enough that with a good zero-day intend in-hand it may be able to break out and affect the host. I don't know about you, but I don't trust myself to be that clever!

DethNinja 5y ago

Change the default ssh port. Most of the attacks are from automated crawlers that try to brute force port 22. Your logs will become much more manageable.

daneel_w 5y ago
I do the same. There's no need at all for my own system's sshd to adhere to any notion of well known ports. Despite the growing availability of pre-mapped host information I can still count the amount of illicit login attempts the past 10 years on two hands.

speedgoose 5y ago

I put SSH on another port and only allow a list of ip ranges on the firewall. I don’t see the point of even allowing Russia and China to fill my logs.

Sami_Lehtinen 5y ago

My servers currently ban in average 1200 individual addresses and around 20 /24 cidr network addresses, which is triggered after N individual addresses in a specific subnet size gets flagged. The amount of abuse traffic is ridiculous.

fuzzy2 5y ago

I just ban China entirely from accessing my server. There's nothing on it a Chinese person could be interested in, just personal stuff and a private forum. Doing so has tremendously reduced the overall (remaining) abuse traffic volume. It's quite easy and efficient to do this using IPSet. IP ranges associated with China are available on the net.

chockchocschoir 5y ago
Before going about a blocking potential people who are in fact interested in your content/service (which you can't know if they are or not based on the country), did you do the bare minimum to secure your server against attackers from any other location, namely changed from the default password and disabled password login? Your approach to security has a number of issues. First, you don't know if someone is actually interested in your thing or not based on the location. They could be visiting China, could still be able to speak English or any other reason. Secondly, the mapping of Location <> IP Address is not as guaranteed as you seem to think. Plenty of IPs get flagged as Chinese while not being in China, and vice-versa is true as well. Just because some 3rd party says a host/client is in a specific location doesn't make that true. Edit: Seems the commentator I replied to now have added "just personal stuff and a private forum" to their comment which was not there before, so most of my point is moot now, as I assumed at least semi-public content/service, not private.
- criddell 5y ago
  I don't think it matters if the geo-location table is correct or not. If traffic from an IP range is entirely malicious, block that IP range. If that range happens to be Chinese or from Florida it doesn't really matter, does it?
  - chockchocschoir 5y ago
    Correct, blocking a IP block based on that malicious traffic comes from there might be a worthwhile strategy (although I'd argue that it's less important than properly configuring your stuff anyways, getting a new IP is trivial), and also a strategy which is different than what fuzzy2 was describing, which is what I was arguing against.

unixhero 5y ago

There is also crowdsec that promises fail2ban functionality from a crowdsourced data feed. https://crowdsec.net/ https://crowdsec.net/

tiku 5y ago

I'm still thinking about adding some Chinese forbidden texts to my headers to block them using their own firewall. Recently Russian IPS started to attack me as well, so perhaps adding something about the war would help block them as well? Any ideas from you guys?

belter 5y ago
https://en.wikipedia.org/wiki/Winnie-the-Pooh https://en.wikipedia.org/wiki/Winnie-the-Pooh

butz 5y ago

I'd assume that most attacks are coming not from attackers directly, but from some sort of hacked devices in some other country, either webcam with root access or similar, maybe even proxy servers. Would be interesting to match malicious IP addresses with ones indexed by shodan to test this theory.

hutch120 5y ago

I see these articles a lot, and always wonder why people go it alone. Can anyone link to a discussion about a distributed community run firewall? Does such a thing exist? If so, please comment.

wila 5y ago
Don't know about "community run firewall", but if you have a few hosts then you can run CSF/LFD in a cluster config. See for example: https://www.nixtree.com/blog/csf-cluster-setup-for-hosting-companies/ https://www.nixtree.com/blog/csf-cluster-setup-for-hosting-c...
klausagnoletti 5y ago
I don't know exaxtly what you mean by a distributed community run firewall but https://crowdsec.net/ https://crowdsec.net/ collects information (anonymously) on the attacks users see and shares it with all other users after vetting them. So in this way the community helps itself (or each other, if you will). Currently around 800k signals are collected daily and around 19k ips are shared back to users as blocklists.

YATA0 5y ago

Port knocking, Wireguard, never look back. You can set an alert for every failed SSH connection because if someone is able to get through that, it's alarming. This setup has the side effect of reducing your log noise to zero. That SNR is super important for intrusion detection.

elesiuta 5y ago
I found just using a different port was enough for me and didn't need port knocking to reduce log noise, which I agree is super important. I also have alerts for both failed SSH or failed wireguard connections, and for any logins from a new IP with either SSH or wireguard.
pseudostem 5y ago
The folks at OpenBSD Misc do not recommend port knocking. IIRC one of the reasons stated was a possibility of getting locked out of your own server. I tried looking up the relevant thread, but am on the phone.
- octoberfranklin 5y ago
  Linux's firewall can do port knocking entirely in the kernel: https://wiki.nftables.org/wiki-nftables/index.php/Port_knocking_example https://wiki.nftables.org/wiki-nftables/index.php/Port_knock... That script gets compiled into BPF and uploaded into the kernel once, at boot/ifup time. All the memory is preallocated. Userspace can be dead/hung/OOM and you can be sure that at least the port knocking won't be why you got locked out.
  - pseudostem 5y ago
    Thank you. One learns something new everyday. And I feel humbled by most comments I read here. I did look up OpenBSD pf again, and it too does port knocking in the kernel. My information was dated (left the misc mailing list at least 5 years ago).
orev 5y ago
An upgrade to port knocking is Single Packet Authorization [1]. It doesn’t suffer from the observability, and other, problems of port knocking. [1] https://www.cipherdyne.org/fwknop/ https://www.cipherdyne.org/fwknop/

zaik 5y ago

It's also worth noting that if an attacker knows how to spoof your IP address, they can lock you out of your own server.

jhgg 5y ago
Yeah? You can't really spoof TCP connections... unless you are talking about doing a BGP hijack. Can you elaborate more on this?
- zaik 5y ago
  It's just something I read here: https://wiki.archlinux.org/title/Fail2ban#Tips_and_tricks https://wiki.archlinux.org/title/Fail2ban#Tips_and_tricks Maybe we can spoof both SYN and ACK and brute force/be lucky with the sequence numbers?

amelius 5y ago

> As a machine learning researcher, I know that I have different tools at my disposal: I could monitor connections over a prolonged period of time, categorise them as hostile or not, and train a transformer to detect hostile connections in real time. All this would take is a long time for data collection and labelling, followed by a lot of GPU hours. It's not so simple. You typically need balanced data, which is difficult to obtain since the attacks don't happen very often (hopefully). This is also why anomaly detection is so difficult.

prima-facie 5y ago

I used SSHGuard in the past which can actually cover a lot more services than just SSH. I imagine this sort of daemon is useful when you have external customers. It also has a touchy behaviour which gradually increases the timeout until it permanently locks out misbehaving clients. Nowadays I just use WireGuard to access my own LAN. But this doesn't scale as well if you need to constantly add and remove clients from the network. For Nginx most bogus requests come directly on the public IP. So you can set up a dummy/catch-all vhost which drops those. https://pastebin.com/MuWgyGGG https://pastebin.com/MuWgyGGG

klausagnoletti 5y ago
https://crowdsec.net/ https://crowdsec.net/ can also do something like that, only more advanced in the attacks it detects and because it's sharing bad ips from users to everyone else. I love that users in this way are watching each other's back.
- prima-facie 5y ago
  Nice tool, thanks.

jakedata 5y ago

I use fail2ban on a server that is listening on a non-standard port. I monitor the bans on a daily basis. The IPs come from all over the world but when China shut down from Covid the login attempts just _stopped_. Like, the silence was deafening, like I thought the server was compromised and logging disabled. It was spooky as hell, but as things came back to something resembling normal, the background radiation started picking up again and I am back to 60-80 bans per day. I have a hell of a list of compromised IPs now.

alyandon 5y ago
I do something similar with firehol lists and iptables/ipfw scripts and it cut my auth log spam down to almost nothing - single digit auth attempts per day per server now usually. My first pass of blocking .cn network space on its own cut my log spam by probably 90% (thousands of attempts per day down to dozens).

kazinator 5y ago

As a machine learning researcher, I know that I have different tools at my disposal: [...] awk '($(NF-1) = /Ban/){print $NF}' /tmp/fail2ban.log \ | sort \ | jdresolve - \ | uniq -c \ | sort -n -r \ | sed -e 's/^[ \t]*//' \ | sed -e 's/ /\t/' \ | head -n 100 :)

Topolomancer 5y ago
That's the joke :)

thg 5y ago

I'm surprised nobody has mentioned ssh-audit yet, so here it is: https://pypi.org/project/ssh-audit/ https://pypi.org/project/ssh-audit/ It's useful for helping in hardening the SSH configuration and there is also a web version here: https://www.ssh-audit.com/ https://www.ssh-audit.com/

xyst 5y ago

I am surprised more people don't have honeypot servers. Would be very easy to lure in unsuspecting victims, open up a reverse shell, drop a payload, and extract any assets.

winternett 5y ago

I've even had my search logs attacked by bots submitting spam search terms multiple times in hopes that I run a "popular search terms" page... Thank goodness I don't allow public comments, it seems like the ability to comment on things may be totally gone by 2024 unless we don't address the specific places the spam is really coming from and why instead of just hardening our own local security.