4 ms·

This is a good opportunity to recommend nft blackhole [1]. Automatically block countries by CIDR blocks and known bad actor IPs. Auto-updates these lists and a

This is a good opportunity to recommend nft blackhole [1]. Automatically block countries by CIDR blocks and known bad actor IPs. Auto-updates these lists and adds them to your firewall. It's a 5 minute install and maintenance free afterwards. Not perfect, but reduces attack surface and log spam. [1] https://github.com/tomasz-c/nft-blackhole https://github.com/tomasz-c/nft-blackhole

chockchocschoir 5y ago
Looks not-so reliable. Either fetches a list of blocks from https://github.com/herrbischoff/country-ip-blocks https://github.com/herrbischoff/country-ip-blocks which is a random GitHub repository that collects "straight from the Regional Internet Registries" without any stating any sources nor method for gathering it (which also, I'm assuming, is self-reported data from those registries), or it fetches it from https://www.ipdeny.com/ https://www.ipdeny.com/ which currently runs with an expired TLS certificate, which on top of everything, nft-blackhole ignores any issues with certificates anyways, leaving it wide open to MITM attacks (https://github.com/tomasz-c/nft-blackhole/blob/8a656ac0a803ad134bc1d4689503a1ef7d052442/nft-blackhole.py#L83-L87 https://github.com/tomasz-c/nft-blackhole/blob/8a656ac0a803a...) I wouldn't run that if I'd want something to reliably block someone from a specific country. > Not perfect, but reduces attack surface and log spam. You know what also does that? Setting up sshd properly in the first place.
- throwmeariver1 5y ago
  Calling the repository of Marcel Bischoff a random GitHub repository. LOL
  - chockchocschoir 5y ago
    Yes, GitHub repositories are generally not considered trust-worthy sources of information unless you actually could cite your resources in the repository itself. This information gathered there has 1) no source stated and 2) no way of reproducing the information yourself, earning it the description of "A Random GitHub Repository", even when you try to appeal to authority.
klausagnoletti 5y ago
How about using a tool like https://crowdsec.net/ https://crowdsec.net/ that collects (basic, anonymious) information from users on the attacks they see, vets it and shares it back to all users via blocklists? Currently around 800k signals are collected and there's around 19k vetted bad ips in the blocklist. Sounds more reliable to me.

chockchocschoir 5y ago

Looks not-so reliable. Either fetches a list of blocks from https://github.com/herrbischoff/country-ip-blocks https://github.com/herrbischoff/country-ip-blocks which is a random GitHub repository that collects "straight from the Regional Internet Registries" without any stating any sources nor method for gathering it (which also, I'm assuming, is self-reported data from those registries), or it fetches it from https://www.ipdeny.com/ https://www.ipdeny.com/ which currently runs with an expired TLS certificate, which on top of everything, nft-blackhole ignores any issues with certificates anyways, leaving it wide open to MITM attacks (https://github.com/tomasz-c/nft-blackhole/blob/8a656ac0a803ad134bc1d4689503a1ef7d052442/nft-blackhole.py#L83-L87 https://github.com/tomasz-c/nft-blackhole/blob/8a656ac0a803a...) I wouldn't run that if I'd want something to reliably block someone from a specific country. > Not perfect, but reduces attack surface and log spam. You know what also does that? Setting up sshd properly in the first place.

throwmeariver1 5y ago
Calling the repository of Marcel Bischoff a random GitHub repository. LOL
- chockchocschoir 5y ago
  Yes, GitHub repositories are generally not considered trust-worthy sources of information unless you actually could cite your resources in the repository itself. This information gathered there has 1) no source stated and 2) no way of reproducing the information yourself, earning it the description of "A Random GitHub Repository", even when you try to appeal to authority.

klausagnoletti 5y ago

How about using a tool like https://crowdsec.net/ https://crowdsec.net/ that collects (basic, anonymious) information from users on the attacks they see, vets it and shares it back to all users via blocklists? Currently around 800k signals are collected and there's around 19k vetted bad ips in the blocklist. Sounds more reliable to me.