3 ms·

I _WANT_ to harvest IP's of PC's trying to SSH into any of my servers. I want them because then I can block ALL traffic coming from their IP's. At my last gig

I _WANT_ to harvest IP's of PC's trying to SSH into any of my servers. I want them because then I can block ALL traffic coming from their IP's. At my last gig, I had thousands of domains and hundreds of servers running on every major (and a shitload of minor) service provider. I custom scripted all these servers to compile all the IP's that attempted a connection, send those lists back to HQ, and then distribute back to each node a block-list table that I could dynamically apply to each edge device. One compromised computer even trying to login was completely blocked from 5000+ domains within 15 minutes. I'm not worried about my ssh login being brute-forced, but if your computer is compromised I want nothing to do with you.

tptacek 4y ago
There is a whole Internet worth of random IPv4 addresses being variously used to variously attack various computers. Your blocklist doesn't even approximate it. What's the point of trying to track and block 0.000000001% of the machines that might be used to attack you?
- 9dev 4y ago
  What’s worse, those IPs are probably (at least in part) dynamic, from VPS servers in data centres, or using residential Proxies or compromised machines behind a NAT. A soon as those addresses change or get assigned another customer, you’re blocking potentially legitimate traffic…
- maltris 4y ago
  I dont see anything wrong in collecting and blocking them for some time, not infinitely of course. Blocking at the firewall effectively means blocking further communication and requests that cost you bandwidth and computing time. Why not save that for the legitimate visitors?
  - swinglock 4y ago
    Because you block legitimate visitors. After we ran out of IPv4 space and started to use CGNAT instead of IPv6, the internet has become a bastardized version of itself.
    - nubinetwork 4y ago
      If carriers/ISPs monitored their networks better (or acted on abuse@ emails), their IPs wouldn't wind up on blocklists (either temporarily or permanently). edit: That isn't to say they should be logging every packet... But if I work for XYZ Hosting Company and spin up a new VM, hand you the IP, and you turn the IP into a mini-shodan scanner... Is the hosting company at least a little responsible for what happens next?
nubinetwork 4y ago
You might be interested in a side project I've been working on... While its similar to sshguard or blocklistd, I didn't know they existed when badips died a couple years back. https://www.nubi-network.com/faq.php https://www.nubi-network.com/faq.php The list file should work for either ingress or egress (or both). I wanted to post about it on here some time ago, but I'm kindof bad at advertising.
ozim 4y ago
I want that for servers I manage.

tptacek 4y ago

There is a whole Internet worth of random IPv4 addresses being variously used to variously attack various computers. Your blocklist doesn't even approximate it. What's the point of trying to track and block 0.000000001% of the machines that might be used to attack you?

9dev 4y ago
What’s worse, those IPs are probably (at least in part) dynamic, from VPS servers in data centres, or using residential Proxies or compromised machines behind a NAT. A soon as those addresses change or get assigned another customer, you’re blocking potentially legitimate traffic…
maltris 4y ago
I dont see anything wrong in collecting and blocking them for some time, not infinitely of course. Blocking at the firewall effectively means blocking further communication and requests that cost you bandwidth and computing time. Why not save that for the legitimate visitors?
- swinglock 4y ago
  Because you block legitimate visitors. After we ran out of IPv4 space and started to use CGNAT instead of IPv6, the internet has become a bastardized version of itself.
  - nubinetwork 4y ago
    If carriers/ISPs monitored their networks better (or acted on abuse@ emails), their IPs wouldn't wind up on blocklists (either temporarily or permanently). edit: That isn't to say they should be logging every packet... But if I work for XYZ Hosting Company and spin up a new VM, hand you the IP, and you turn the IP into a mini-shodan scanner... Is the hosting company at least a little responsible for what happens next?

nubinetwork 4y ago

You might be interested in a side project I've been working on... While its similar to sshguard or blocklistd, I didn't know they existed when badips died a couple years back. https://www.nubi-network.com/faq.php https://www.nubi-network.com/faq.php The list file should work for either ingress or egress (or both). I wanted to post about it on here some time ago, but I'm kindof bad at advertising.

ozim 4y ago

I want that for servers I manage.