4 ms·

Before going about a blocking potential people who are in fact interested in your content/service (which you can't know if they are or not based on the country)

Before going about a blocking potential people who are in fact interested in your content/service (which you can't know if they are or not based on the country), did you do the bare minimum to secure your server against attackers from any other location, namely changed from the default password and disabled password login? Your approach to security has a number of issues. First, you don't know if someone is actually interested in your thing or not based on the location. They could be visiting China, could still be able to speak English or any other reason. Secondly, the mapping of Location <> IP Address is not as guaranteed as you seem to think. Plenty of IPs get flagged as Chinese while not being in China, and vice-versa is true as well. Just because some 3rd party says a host/client is in a specific location doesn't make that true. Edit: Seems the commentator I replied to now have added "just personal stuff and a private forum" to their comment which was not there before, so most of my point is moot now, as I assumed at least semi-public content/service, not private.

criddell 5y ago
I don't think it matters if the geo-location table is correct or not. If traffic from an IP range is entirely malicious, block that IP range. If that range happens to be Chinese or from Florida it doesn't really matter, does it?
- chockchocschoir 5y ago
  Correct, blocking a IP block based on that malicious traffic comes from there might be a worthwhile strategy (although I'd argue that it's less important than properly configuring your stuff anyways, getting a new IP is trivial), and also a strategy which is different than what fuzzy2 was describing, which is what I was arguing against.
- nkozyra 5y ago
  Most of the time these malicious attacks will come from a data center, where someone is no doubt leasing some hardware until they get shut down. When I get any number of malicious known attack vectors, I have a process that runs a few services against the IP for geolocation and server info. If it's a known data center, its block is immediately blocked, otherwise just the IP. For whatever reason, they tend not to get new ips easily, so shutting down the IP will usually buy a few days before they have a new instance on qualys or whatever.
- alam2000 5y ago
fuzzy2 5y ago
Yes, the server is of course properly secured. There was something that made me do this in the past, but I don't remember. Never had any problems with it whatsoever. I do know, because my services (except the forum) are for me exclusively. On the forum, I know everyone. None of the members live in China, have relatives in China or travel to China. If they cannot access the forum, they can contact me in another way.
- chockchocschoir 5y ago
  Yeah, if you're running private services, then my point is moot of course, should have known :) Thanks for explaining though.
michaelcampbell 5y ago
I DO run a "public" service, in that it provides some info to people. However I run it at totally my own cost, the information is for entertainment value only (and not in the "I just say that to get around this being horrible in some way"; it's literally information about gaming and games), and I just don't need the hassle of the constant hack attempts. I block China and Russia, and have for years, using publicly available IP ranges. Yes, I know it's not going to get just China and Russia. Yes I know I'm blocking false positives. Yes I know I'm allowing false negatives. And honestly, I couldn't care less. It's my service, my information, my time, and my money, and I don't feel the least bit bad nor swayed by some appeal to morality or fairness. > Your approach to security has a number of issues. Your examples are a bit of non-sequitur. If I OVERBAN, I'm not decreasing my security. The non-(Chinese hacker) visitor in China can't get in, that's not a security issue. IP's being flagged as Chinese not being in China... can't get in also not a security issue. Vice versa is a bit of a security issue, with which the second layer of my security onion deals.
- Skiiing 5y ago
  You typed my thoughts exactly. I run a popular website, and I just block everything from China, and do a Captcha challenge for others such as Russia. People don't have the right to access my website. If a Chinese citizen is (correctly) angry about the situation then they need to petition their government to change the culture that permits massive continuous hacking attempts from their country. I use Cloudflare which makes blocking countries simple, no need to keep updated IP lists.
- grog454 5y ago
  Honest question: what impact did you see when you switched from not blocking China + Russia to blocking them? What type of attacks are you seeing primarily? Failed login attempts / brute force attempts seem like the cost of doing business in public. I assume that if my servers are accessible from 1 or more public addresses, they WILL be subject to brute force attempts. I also assume that by making my passwords sufficiently randomized, the probability of these attacks having any effect is infinitesimal. To me, blocking an IP because it tried to log in to your servers seems purely like a fear response with no rational basis (or at least a poor understanding of probability / stats). By extension, blocking a range of IPs because of some arbitrarily elevated frequency of login attempts seems equally silly. Now for DOS attacks, temporary IP blocks make perfect sense.
dylan604 5y ago
> I assumed at least semi-public content/service, not private. Um, they posted information on a public website. It's not private. Even if the site is owned by them, it is publicly available, of their own accord.
- chockchocschoir 5y ago
  "personal stuff" and "private forums" is probably as private as it gets, for being something accessible on the web, and I wouldn't call those publicly available, as you'd need to pass some sort of authorization/authentication to be able to see it. Or I gravely misunderstand your comment.
IncRnd 5y ago
Not the GP, but every web server I've ever run has had IP addresses originating from China at the top of the frequency list for nefarious attempts to compromise the security. If someone is temporarily visiting China and wants to visit one of my websites, they can wait until they return. I've not removing my blocks on IP addresses.

criddell 5y ago

I don't think it matters if the geo-location table is correct or not. If traffic from an IP range is entirely malicious, block that IP range. If that range happens to be Chinese or from Florida it doesn't really matter, does it?

chockchocschoir 5y ago
Correct, blocking a IP block based on that malicious traffic comes from there might be a worthwhile strategy (although I'd argue that it's less important than properly configuring your stuff anyways, getting a new IP is trivial), and also a strategy which is different than what fuzzy2 was describing, which is what I was arguing against.
nkozyra 5y ago
Most of the time these malicious attacks will come from a data center, where someone is no doubt leasing some hardware until they get shut down. When I get any number of malicious known attack vectors, I have a process that runs a few services against the IP for geolocation and server info. If it's a known data center, its block is immediately blocked, otherwise just the IP. For whatever reason, they tend not to get new ips easily, so shutting down the IP will usually buy a few days before they have a new instance on qualys or whatever.
alam2000 5y ago

fuzzy2 5y ago

Yes, the server is of course properly secured. There was something that made me do this in the past, but I don't remember. Never had any problems with it whatsoever. I do know, because my services (except the forum) are for me exclusively. On the forum, I know everyone. None of the members live in China, have relatives in China or travel to China. If they cannot access the forum, they can contact me in another way.

chockchocschoir 5y ago
Yeah, if you're running private services, then my point is moot of course, should have known :) Thanks for explaining though.

michaelcampbell 5y ago

I DO run a "public" service, in that it provides some info to people. However I run it at totally my own cost, the information is for entertainment value only (and not in the "I just say that to get around this being horrible in some way"; it's literally information about gaming and games), and I just don't need the hassle of the constant hack attempts. I block China and Russia, and have for years, using publicly available IP ranges. Yes, I know it's not going to get just China and Russia. Yes I know I'm blocking false positives. Yes I know I'm allowing false negatives. And honestly, I couldn't care less. It's my service, my information, my time, and my money, and I don't feel the least bit bad nor swayed by some appeal to morality or fairness. > Your approach to security has a number of issues. Your examples are a bit of non-sequitur. If I OVERBAN, I'm not decreasing my security. The non-(Chinese hacker) visitor in China can't get in, that's not a security issue. IP's being flagged as Chinese not being in China... can't get in also not a security issue. Vice versa is a bit of a security issue, with which the second layer of my security onion deals.

Skiiing 5y ago
You typed my thoughts exactly. I run a popular website, and I just block everything from China, and do a Captcha challenge for others such as Russia. People don't have the right to access my website. If a Chinese citizen is (correctly) angry about the situation then they need to petition their government to change the culture that permits massive continuous hacking attempts from their country. I use Cloudflare which makes blocking countries simple, no need to keep updated IP lists.
grog454 5y ago
Honest question: what impact did you see when you switched from not blocking China + Russia to blocking them? What type of attacks are you seeing primarily? Failed login attempts / brute force attempts seem like the cost of doing business in public. I assume that if my servers are accessible from 1 or more public addresses, they WILL be subject to brute force attempts. I also assume that by making my passwords sufficiently randomized, the probability of these attacks having any effect is infinitesimal. To me, blocking an IP because it tried to log in to your servers seems purely like a fear response with no rational basis (or at least a poor understanding of probability / stats). By extension, blocking a range of IPs because of some arbitrarily elevated frequency of login attempts seems equally silly. Now for DOS attacks, temporary IP blocks make perfect sense.

dylan604 5y ago

> I assumed at least semi-public content/service, not private. Um, they posted information on a public website. It's not private. Even if the site is owned by them, it is publicly available, of their own accord.

chockchocschoir 5y ago
"personal stuff" and "private forums" is probably as private as it gets, for being something accessible on the web, and I wouldn't call those publicly available, as you'd need to pass some sort of authorization/authentication to be able to see it. Or I gravely misunderstand your comment.

IncRnd 5y ago

Not the GP, but every web server I've ever run has had IP addresses originating from China at the top of the frequency list for nefarious attempts to compromise the security. If someone is temporarily visiting China and wants to visit one of my websites, they can wait until they return. I've not removing my blocks on IP addresses.