8 ms·

I just ban China entirely from accessing my server. There's nothing on it a Chinese person could be interested in, just personal stuff and a private forum. Doin

by fuzzy2 5y ago

I just ban China entirely from accessing my server. There's nothing on it a Chinese person could be interested in, just personal stuff and a private forum. Doing so has tremendously reduced the overall (remaining) abuse traffic volume. It's quite easy and efficient to do this using IPSet. IP ranges associated with China are available on the net.

chockchocschoir 5y ago
Before going about a blocking potential people who are in fact interested in your content/service (which you can't know if they are or not based on the country), did you do the bare minimum to secure your server against attackers from any other location, namely changed from the default password and disabled password login? Your approach to security has a number of issues. First, you don't know if someone is actually interested in your thing or not based on the location. They could be visiting China, could still be able to speak English or any other reason. Secondly, the mapping of Location <> IP Address is not as guaranteed as you seem to think. Plenty of IPs get flagged as Chinese while not being in China, and vice-versa is true as well. Just because some 3rd party says a host/client is in a specific location doesn't make that true. Edit: Seems the commentator I replied to now have added "just personal stuff and a private forum" to their comment which was not there before, so most of my point is moot now, as I assumed at least semi-public content/service, not private.
- criddell 5y ago
  I don't think it matters if the geo-location table is correct or not. If traffic from an IP range is entirely malicious, block that IP range. If that range happens to be Chinese or from Florida it doesn't really matter, does it?
  - chockchocschoir 5y ago
    Correct, blocking a IP block based on that malicious traffic comes from there might be a worthwhile strategy (although I'd argue that it's less important than properly configuring your stuff anyways, getting a new IP is trivial), and also a strategy which is different than what fuzzy2 was describing, which is what I was arguing against.
  - nkozyra 5y ago
    Most of the time these malicious attacks will come from a data center, where someone is no doubt leasing some hardware until they get shut down. When I get any number of malicious known attack vectors, I have a process that runs a few services against the IP for geolocation and server info. If it's a known data center, its block is immediately blocked, otherwise just the IP. For whatever reason, they tend not to get new ips easily, so shutting down the IP will usually buy a few days before they have a new instance on qualys or whatever.
  - alam2000 5y ago
- fuzzy2 5y ago
  Yes, the server is of course properly secured. There was something that made me do this in the past, but I don't remember. Never had any problems with it whatsoever. I do know, because my services (except the forum) are for me exclusively. On the forum, I know everyone. None of the members live in China, have relatives in China or travel to China. If they cannot access the forum, they can contact me in another way.
  - chockchocschoir 5y ago
    Yeah, if you're running private services, then my point is moot of course, should have known :) Thanks for explaining though.
- michaelcampbell 5y ago
  I DO run a "public" service, in that it provides some info to people. However I run it at totally my own cost, the information is for entertainment value only (and not in the "I just say that to get around this being horrible in some way"; it's literally information about gaming and games), and I just don't need the hassle of the constant hack attempts. I block China and Russia, and have for years, using publicly available IP ranges. Yes, I know it's not going to get just China and Russia. Yes I know I'm blocking false positives. Yes I know I'm allowing false negatives. And honestly, I couldn't care less. It's my service, my information, my time, and my money, and I don't feel the least bit bad nor swayed by some appeal to morality or fairness. > Your approach to security has a number of issues. Your examples are a bit of non-sequitur. If I OVERBAN, I'm not decreasing my security. The non-(Chinese hacker) visitor in China can't get in, that's not a security issue. IP's being flagged as Chinese not being in China... can't get in also not a security issue. Vice versa is a bit of a security issue, with which the second layer of my security onion deals.
  - Skiiing 5y ago
    You typed my thoughts exactly. I run a popular website, and I just block everything from China, and do a Captcha challenge for others such as Russia. People don't have the right to access my website. If a Chinese citizen is (correctly) angry about the situation then they need to petition their government to change the culture that permits massive continuous hacking attempts from their country. I use Cloudflare which makes blocking countries simple, no need to keep updated IP lists.
  - grog454 5y ago
    Honest question: what impact did you see when you switched from not blocking China + Russia to blocking them? What type of attacks are you seeing primarily? Failed login attempts / brute force attempts seem like the cost of doing business in public. I assume that if my servers are accessible from 1 or more public addresses, they WILL be subject to brute force attempts. I also assume that by making my passwords sufficiently randomized, the probability of these attacks having any effect is infinitesimal. To me, blocking an IP because it tried to log in to your servers seems purely like a fear response with no rational basis (or at least a poor understanding of probability / stats). By extension, blocking a range of IPs because of some arbitrarily elevated frequency of login attempts seems equally silly. Now for DOS attacks, temporary IP blocks make perfect sense.
- dylan604 5y ago
  > I assumed at least semi-public content/service, not private. Um, they posted information on a public website. It's not private. Even if the site is owned by them, it is publicly available, of their own accord.
  - chockchocschoir 5y ago
    "personal stuff" and "private forums" is probably as private as it gets, for being something accessible on the web, and I wouldn't call those publicly available, as you'd need to pass some sort of authorization/authentication to be able to see it. Or I gravely misunderstand your comment.
- IncRnd 5y ago
  Not the GP, but every web server I've ever run has had IP addresses originating from China at the top of the frequency list for nefarious attempts to compromise the security. If someone is temporarily visiting China and wants to visit one of my websites, they can wait until they return. I've not removing my blocks on IP addresses.
Topolomancer 5y ago
Not an option for me, but thanks for the suggestion. I don't want to erect a geo-fence here.
- dym_sh 5y ago
  chinese goverment already did that for you. anyone who really needs to access you site from inside china will use vpn or tor.
  - tartoran 5y ago
    Does China really ban all outside access or they only ban some specific sources such as newspapers and info they deem dangerous to their propaganda?
temp8964 5y ago
And also legitimate Chinese visitors will use VPN to access foreign websites anyway. Because of the GreatFirewall, a Chinese person must use a VPN to reliably visit foreign websites.
qwertox 5y ago
I do the same, but my issue is with rented servers on AWS, Digital Ocean and the like. There's no way of knowing who owns a rented IP address, the WHOIS record just outputs "US", which is meaningles. I think there's an need for forcing service providers to group IP blocks by the nationality of who rents them. Just to be clear, this is in the context of my private servers which host my mailserver as well as my personal website which is not meant for public consumption, but which I need to be publicly available.
- fuzzy2 5y ago
  > I think there's an need for forcing service providers to group IP blocks by the nationality of who rents them. But what would that accomplish? Unlike rogue ISPs in other countries, big cloud providers have abuse reporting that actually works. Or just block all of them outright if they do not need to access your services.
  - gkbrk 5y ago
    Depends on the country the cloud provider is located in. I have had zero luck getting anything taken down by reporting to abuse emails or forms of Aliyun, for example. I have had much better luck with US or EU based cloud providers. In particular, I remember DigitalOcean being very responsive.
    - fuzzy2 5y ago
      Alibaba Cloud? I actually would’ve expected better from them! Never had to report anything myself, seeing how I’m probably blocking them. I recently had contact with AWS about spam sent using SES and found the response times very quick and the replies appropriate (they’ll look into it but cannot report back, what I expected anyway). This particular spam stopped coming, but that could be a coincidence.
- jcynix 5y ago
  > I think there's an need for forcing service providers to group IP blocks by the nationality of who rents them. Would neither help nor work, as there's TOR and VPNs to access your servers from anywhere in the wirld.
reaperducer 5y ago
IP ranges associated with China are available on the net. Didn't help me all that much. Most of the abuse and spam leveled at the servers I manage come through $5 DigitalOcean servers being used as relays. It's the same thing that ruined voice telephony: Make the connection so cheap that it can be abused at scale.
- Spivak 5y ago
  I mean just block VPC ranges then. They’re public, and lots of sites already do it. I would bet you don’t expect and traffic originating from rented servers.
jotm 5y ago
That's kinda against the spirit of the Internet, well, what it should be IMO. But I do also ban, only temporarily. I found that a lot of IPs just stop reappearing/retrying, likely because they blacklist my IP and move on.
walrus01 5y ago
this seems to presume that malicious things originating in china scanning/probing other peoples' IP ranges don't use proxies or rented VMs, or relay compromised hosts almost anywhere in the world, etc. all that banning chinese /16 or /12 size netblocks will do is cut down on the clutter in your logs, not actually accomplish anything. getting scanned and probed by peoples' automated tools looking for vulnerabel daemon RCEs has been a log clutter issue for about 25 years or more now. it's part of the background noise of the internet. ever since the days of having your http daemon logs cluttered up with GET DEFAULT.IDA stuff and similar in 2001. https://www.google.com/search?client=firefox-b-1-d&q=get+default.ida https://www.google.com/search?client=firefox-b-1-d&q=get+def... put more effort into ensuring that public facing daemons are totally up to date and hardened against external compromise. Or better yet don't have them public facing at all, if you can admin your server via an ssh daemon that only listens on a logical vpn interface or some sort of OOB interface.
- holoduke 5y ago
  Totally agree. Sometimes I watch my live logs of auth.log of about 100 public servers. I am probably see 10 port scans or ssh attempts per second from random machines. Nothing to worry about if machines setup correctly. More worrying are the people who try to break our public APIs. Either by letting it to crash, brute force operations etc. The security flaws are often inside the software domain layer.
  - raegis 5y ago
    Wow. I'm looking at only one of my servers and there is a root login attempt every second. I feel a little embarrassed I am surprised by this.
- mrjin 5y ago
  IPs on the log files most likely are exit proxies if those attackers were not rookies. Simply change the SSH port only would deter 90% of those attempts per my personal experience.
  - 5y ago
aghostincarrot 5y ago
rdtsc 5y ago
I did the same thing - blocked China, then moved the SSH login to another port. It cut down some log noise which was good enough for us.
teleforce 5y ago
Please check this very interesting real-time Live Threat Map by Radware [1]. Most of these attacks are harmless and the attacks that you should be worried is the Advanced Persistent Threat (APT) types [2]. Around eight years back I've proposed a system for crowdsourcing in covertly detecting APT similar to the minefields concept being used in war and I still think it's the best way to reliably detect APT including zero-day attacks. Few months back in HN someone proposed an open source solution for crowdsourcing firewall, IDS and IPS but cannot get the link for now on top of my head at the moment. [1] Live Threat Map: https://livethreatmap.radware.com/ https://livethreatmap.radware.com/ [2] Advanced Persistent Trap: https://en.wikipedia.org/wiki/Advanced_persistent_threat https://en.wikipedia.org/wiki/Advanced_persistent_threat
deleted 5y ago
[deleted]

by fuzzy2 5y ago

chockchocschoir 5y ago

Before going about a blocking potential people who are in fact interested in your content/service (which you can't know if they are or not based on the country), did you do the bare minimum to secure your server against attackers from any other location, namely changed from the default password and disabled password login? Your approach to security has a number of issues. First, you don't know if someone is actually interested in your thing or not based on the location. They could be visiting China, could still be able to speak English or any other reason. Secondly, the mapping of Location <> IP Address is not as guaranteed as you seem to think. Plenty of IPs get flagged as Chinese while not being in China, and vice-versa is true as well. Just because some 3rd party says a host/client is in a specific location doesn't make that true. Edit: Seems the commentator I replied to now have added "just personal stuff and a private forum" to their comment which was not there before, so most of my point is moot now, as I assumed at least semi-public content/service, not private.

criddell 5y ago
I don't think it matters if the geo-location table is correct or not. If traffic from an IP range is entirely malicious, block that IP range. If that range happens to be Chinese or from Florida it doesn't really matter, does it?
- chockchocschoir 5y ago
  Correct, blocking a IP block based on that malicious traffic comes from there might be a worthwhile strategy (although I'd argue that it's less important than properly configuring your stuff anyways, getting a new IP is trivial), and also a strategy which is different than what fuzzy2 was describing, which is what I was arguing against.
- nkozyra 5y ago
  Most of the time these malicious attacks will come from a data center, where someone is no doubt leasing some hardware until they get shut down. When I get any number of malicious known attack vectors, I have a process that runs a few services against the IP for geolocation and server info. If it's a known data center, its block is immediately blocked, otherwise just the IP. For whatever reason, they tend not to get new ips easily, so shutting down the IP will usually buy a few days before they have a new instance on qualys or whatever.
- alam2000 5y ago
fuzzy2 5y ago
Yes, the server is of course properly secured. There was something that made me do this in the past, but I don't remember. Never had any problems with it whatsoever. I do know, because my services (except the forum) are for me exclusively. On the forum, I know everyone. None of the members live in China, have relatives in China or travel to China. If they cannot access the forum, they can contact me in another way.
- chockchocschoir 5y ago
  Yeah, if you're running private services, then my point is moot of course, should have known :) Thanks for explaining though.
michaelcampbell 5y ago
I DO run a "public" service, in that it provides some info to people. However I run it at totally my own cost, the information is for entertainment value only (and not in the "I just say that to get around this being horrible in some way"; it's literally information about gaming and games), and I just don't need the hassle of the constant hack attempts. I block China and Russia, and have for years, using publicly available IP ranges. Yes, I know it's not going to get just China and Russia. Yes I know I'm blocking false positives. Yes I know I'm allowing false negatives. And honestly, I couldn't care less. It's my service, my information, my time, and my money, and I don't feel the least bit bad nor swayed by some appeal to morality or fairness. > Your approach to security has a number of issues. Your examples are a bit of non-sequitur. If I OVERBAN, I'm not decreasing my security. The non-(Chinese hacker) visitor in China can't get in, that's not a security issue. IP's being flagged as Chinese not being in China... can't get in also not a security issue. Vice versa is a bit of a security issue, with which the second layer of my security onion deals.
- Skiiing 5y ago
  You typed my thoughts exactly. I run a popular website, and I just block everything from China, and do a Captcha challenge for others such as Russia. People don't have the right to access my website. If a Chinese citizen is (correctly) angry about the situation then they need to petition their government to change the culture that permits massive continuous hacking attempts from their country. I use Cloudflare which makes blocking countries simple, no need to keep updated IP lists.
- grog454 5y ago
  Honest question: what impact did you see when you switched from not blocking China + Russia to blocking them? What type of attacks are you seeing primarily? Failed login attempts / brute force attempts seem like the cost of doing business in public. I assume that if my servers are accessible from 1 or more public addresses, they WILL be subject to brute force attempts. I also assume that by making my passwords sufficiently randomized, the probability of these attacks having any effect is infinitesimal. To me, blocking an IP because it tried to log in to your servers seems purely like a fear response with no rational basis (or at least a poor understanding of probability / stats). By extension, blocking a range of IPs because of some arbitrarily elevated frequency of login attempts seems equally silly. Now for DOS attacks, temporary IP blocks make perfect sense.
dylan604 5y ago
> I assumed at least semi-public content/service, not private. Um, they posted information on a public website. It's not private. Even if the site is owned by them, it is publicly available, of their own accord.
- chockchocschoir 5y ago
  "personal stuff" and "private forums" is probably as private as it gets, for being something accessible on the web, and I wouldn't call those publicly available, as you'd need to pass some sort of authorization/authentication to be able to see it. Or I gravely misunderstand your comment.
IncRnd 5y ago
Not the GP, but every web server I've ever run has had IP addresses originating from China at the top of the frequency list for nefarious attempts to compromise the security. If someone is temporarily visiting China and wants to visit one of my websites, they can wait until they return. I've not removing my blocks on IP addresses.

Topolomancer 5y ago

Not an option for me, but thanks for the suggestion. I don't want to erect a geo-fence here.

dym_sh 5y ago
chinese goverment already did that for you. anyone who really needs to access you site from inside china will use vpn or tor.
- tartoran 5y ago
  Does China really ban all outside access or they only ban some specific sources such as newspapers and info they deem dangerous to their propaganda?

temp8964 5y ago

And also legitimate Chinese visitors will use VPN to access foreign websites anyway. Because of the GreatFirewall, a Chinese person must use a VPN to reliably visit foreign websites.

qwertox 5y ago

I do the same, but my issue is with rented servers on AWS, Digital Ocean and the like. There's no way of knowing who owns a rented IP address, the WHOIS record just outputs "US", which is meaningles. I think there's an need for forcing service providers to group IP blocks by the nationality of who rents them. Just to be clear, this is in the context of my private servers which host my mailserver as well as my personal website which is not meant for public consumption, but which I need to be publicly available.

fuzzy2 5y ago
> I think there's an need for forcing service providers to group IP blocks by the nationality of who rents them. But what would that accomplish? Unlike rogue ISPs in other countries, big cloud providers have abuse reporting that actually works. Or just block all of them outright if they do not need to access your services.
- gkbrk 5y ago
  Depends on the country the cloud provider is located in. I have had zero luck getting anything taken down by reporting to abuse emails or forms of Aliyun, for example. I have had much better luck with US or EU based cloud providers. In particular, I remember DigitalOcean being very responsive.
  - fuzzy2 5y ago
    Alibaba Cloud? I actually would’ve expected better from them! Never had to report anything myself, seeing how I’m probably blocking them. I recently had contact with AWS about spam sent using SES and found the response times very quick and the replies appropriate (they’ll look into it but cannot report back, what I expected anyway). This particular spam stopped coming, but that could be a coincidence.
jcynix 5y ago
> I think there's an need for forcing service providers to group IP blocks by the nationality of who rents them. Would neither help nor work, as there's TOR and VPNs to access your servers from anywhere in the wirld.

reaperducer 5y ago

IP ranges associated with China are available on the net. Didn't help me all that much. Most of the abuse and spam leveled at the servers I manage come through $5 DigitalOcean servers being used as relays. It's the same thing that ruined voice telephony: Make the connection so cheap that it can be abused at scale.

Spivak 5y ago
I mean just block VPC ranges then. They’re public, and lots of sites already do it. I would bet you don’t expect and traffic originating from rented servers.

jotm 5y ago

That's kinda against the spirit of the Internet, well, what it should be IMO. But I do also ban, only temporarily. I found that a lot of IPs just stop reappearing/retrying, likely because they blacklist my IP and move on.

walrus01 5y ago

this seems to presume that malicious things originating in china scanning/probing other peoples' IP ranges don't use proxies or rented VMs, or relay compromised hosts almost anywhere in the world, etc. all that banning chinese /16 or /12 size netblocks will do is cut down on the clutter in your logs, not actually accomplish anything. getting scanned and probed by peoples' automated tools looking for vulnerabel daemon RCEs has been a log clutter issue for about 25 years or more now. it's part of the background noise of the internet. ever since the days of having your http daemon logs cluttered up with GET DEFAULT.IDA stuff and similar in 2001. https://www.google.com/search?client=firefox-b-1-d&q=get+default.ida https://www.google.com/search?client=firefox-b-1-d&q=get+def... put more effort into ensuring that public facing daemons are totally up to date and hardened against external compromise. Or better yet don't have them public facing at all, if you can admin your server via an ssh daemon that only listens on a logical vpn interface or some sort of OOB interface.

holoduke 5y ago
Totally agree. Sometimes I watch my live logs of auth.log of about 100 public servers. I am probably see 10 port scans or ssh attempts per second from random machines. Nothing to worry about if machines setup correctly. More worrying are the people who try to break our public APIs. Either by letting it to crash, brute force operations etc. The security flaws are often inside the software domain layer.
- raegis 5y ago
  Wow. I'm looking at only one of my servers and there is a root login attempt every second. I feel a little embarrassed I am surprised by this.
mrjin 5y ago
IPs on the log files most likely are exit proxies if those attackers were not rookies. Simply change the SSH port only would deter 90% of those attempts per my personal experience.
- 5y ago

aghostincarrot 5y ago

rdtsc 5y ago

I did the same thing - blocked China, then moved the SSH login to another port. It cut down some log noise which was good enough for us.

teleforce 5y ago

Please check this very interesting real-time Live Threat Map by Radware [1]. Most of these attacks are harmless and the attacks that you should be worried is the Advanced Persistent Threat (APT) types [2]. Around eight years back I've proposed a system for crowdsourcing in covertly detecting APT similar to the minefields concept being used in war and I still think it's the best way to reliably detect APT including zero-day attacks. Few months back in HN someone proposed an open source solution for crowdsourcing firewall, IDS and IPS but cannot get the link for now on top of my head at the moment. [1] Live Threat Map: https://livethreatmap.radware.com/ https://livethreatmap.radware.com/ [2] Advanced Persistent Trap: https://en.wikipedia.org/wiki/Advanced_persistent_threat https://en.wikipedia.org/wiki/Advanced_persistent_threat

deleted 5y ago

[deleted]