6 ms·

Seeing how fast people will probe you after you get a new TLS certificate

96 points by jyunwai 3y ago

happytiger 3y ago
That seems remarkably slow compared to what I have experienced recently. 2-3 minutes to port scan is generally what I expect. In fact it’s a good idea to simply black hole and ban the first couple hours of traffic on a new setup. Gets rid of a lot of bad actors with little downside. But this is for personal stuff.
- rewmie 3y ago
  > In fact it’s a good idea to simply black hole and ban the first couple hours of traffic on a new setup. Thanks for the suggestion. I'll definitely consider that trick with my upcoming setups.
rambambram 3y ago
Baidu and other Chinese traffic is usually pretty quick to pay a visit when I set up a new domain.
jofla_net 3y ago
So very true. Thats why i, for private things, never bother with domain names, signed certs, and use non standard ports. All of the above are huge lawn signs for "target". This of course drives all sorts of chrome browsers and mitm stuff bonkers. So the next time someone asks why you dont want to buy into the dns/cert route, tell them this. Inb4, i know the whole subsequent argument chain, nevertheless, this reduces the activity. yes, yes it does.
- dspillett 3y ago
  > this reduces the activity. yes, yes it does. Does it reduce it quantifiably, and usefully, long term? I've had the discussion about running SSHd on a non-standard port with a few people over the years. I've never been convinced that saving a bit of log file space is worth the reconfiguration time, nor that the security benefits are significant (assuming a secure config otherwise of course) given that at least some sophisticated actors prove I non-standard ports for the presence of services.
  - xvector 3y ago
    There have been 0days in sshd. Typically automatic attack scanners don't bother with nonstandard ports when carrying out these attacks. So I would say yes, it's worth it.
    - mistrial9 3y ago
      you mean Heartbleed? what else..
  - justsomehnguy 3y ago
    > I've never been convinced that saving a bit of log file space sigh It's not the log file space, it absence of failed attempts in the logs.
    - bigiain 3y ago
      Yep. Especially if there's a suspected incident or a new vulnerability announced, I'd much rather be reading port 2234 sshd logs that port 22 sshd logs - far less haystack to wade through looking for needles. And as another comment mentions, every time an sshd zero day is announced, pretty much the entire IPv4 address space gets probed on port 22 within about 30 minutes. A non standard port number _might_ buy you an extra hour or three if you've got a vulnerable sshd. But don't rely on that - someone's bound to have portscanned you recently enough and knows you've got OpenSSH_8.2p1 listening on port 2234 (or whatever) and they won't be far behind the whole-internet port 22 exploit probes.
  - drpixie 3y ago
    I've certainly had lots of login probes at common non-standard ports - 22+n for easy to remember n. But it's nice to have the logs reasonably clean, makes it easier to see real problems.
  - throw0101b 3y ago
    > I've never been convinced that saving a bit of log file space is worth the reconfiguration time […] This is relatively easy to do with Ansible (or whatever). My main concern as a sysadmin in a company is user training and telling folks to use the non-standard ports. If I could use SRV records for 'service (port) discovery' that'd be helpful.
- rajamaka 3y ago
  Kind of throwing the baby out with the bathwater no? Just block the ports/traffic and enjoy the convenience of DNS / signed certs.
- nyanpasu64 3y ago
  I think that requiring world-visible TLS certificates for LAN-local web services compromises the privacy of the infrastructure I run in my bedroom for my own usage.
  - lysp 3y ago
    I use a wildcard for mine. *.locallan.domain.com It exposes part of the domain, but none of the services. If you want to be even more secure, you could null-IP the wildcard and only allocate IPs for subdomains that you use.
wrx100 3y ago
If you close all the ports you do not use and properly configure all services that listen on the ports that you do use, should you care? Should you bother with black holing, port knockers, non-standard port or even firewalls for that matter? Honest question
- tsujamin 3y ago
  Use one of the dial-outward mesh VPNs or authenticating proxies (Tailscale, MS AppProxy, CF Tunnels etc), block all incoming traffic and stop caring all together imo
- jcrawfordor 3y ago
  Probably not. This kind of scanning is essentially nuisance behavior. Like any nuisance, you could ignore it, or you could take action to suppress it. Where you land on that is largely personal opinion, but for a commercial project you should probably lean towards "ignoring" since any action against tends to create the possibility of false positives that affect customers. For personal use, I do feel that Wireguard or managed Wireguard setups like Tailscale are so easy to use that putting everything behind a VPN is cheap insurance and even convenient, since it takes care of NAT traversal for you.
- bigiain 3y ago
  For me at least, firewalls are worthwhile for "defence in depth". I may have closed off all services I'm not using, but a firewall will still help if I forget one or if I later accidentally start something that listens on a port. I also use blackholing (with fail2ban) and non standard ports (for ssh) - but just as a way to quiet down log files rather than ascribing much ion the way of security benefits to them.
  - throw0101b 3y ago
    > I also use blackholing (with fail2ban) and non standard ports (for ssh) - but just as a way to quiet down log files rather than ascribing much ion the way of security benefits to them. Just switch to IPv6: good luck scanning a /64. :)
DeathArrow 3y ago
Can this port scanning be equivalent to a small DDOS. Wouldn't impact legitimate traffic?
- willcipriano 3y ago
  Not on anything bigger than a raspberry pi on a dial up connection, no.
redrove 3y ago
This is one of the reasons why I only use wildcard certs; yes, it’s security through obscurity to some extent, but it does work.
xg15 3y ago
The whole "the internet is a Dark Forest" hypothesis is kinda moot if you have industrial-strength floodlights like Certificate Transparency inbetween.
takinola 3y ago
This is nothing compared with how fast your email and phone numbers will be hammered as soon as you register a new domain.

96 points by jyunwai 3y ago

That seems remarkably slow compared to what I have experienced recently. 2-3 minutes to port scan is generally what I expect. In fact it’s a good idea to simply black hole and ban the first couple hours of traffic on a new setup. Gets rid of a lot of bad actors with little downside. But this is for personal stuff.

rewmie 3y ago
> In fact it’s a good idea to simply black hole and ban the first couple hours of traffic on a new setup. Thanks for the suggestion. I'll definitely consider that trick with my upcoming setups.

rambambram 3y ago

Baidu and other Chinese traffic is usually pretty quick to pay a visit when I set up a new domain.

jofla_net 3y ago

So very true. Thats why i, for private things, never bother with domain names, signed certs, and use non standard ports. All of the above are huge lawn signs for "target". This of course drives all sorts of chrome browsers and mitm stuff bonkers. So the next time someone asks why you dont want to buy into the dns/cert route, tell them this. Inb4, i know the whole subsequent argument chain, nevertheless, this reduces the activity. yes, yes it does.

dspillett 3y ago
> this reduces the activity. yes, yes it does. Does it reduce it quantifiably, and usefully, long term? I've had the discussion about running SSHd on a non-standard port with a few people over the years. I've never been convinced that saving a bit of log file space is worth the reconfiguration time, nor that the security benefits are significant (assuming a secure config otherwise of course) given that at least some sophisticated actors prove I non-standard ports for the presence of services.
- xvector 3y ago
  There have been 0days in sshd. Typically automatic attack scanners don't bother with nonstandard ports when carrying out these attacks. So I would say yes, it's worth it.
  - mistrial9 3y ago
    you mean Heartbleed? what else..
- justsomehnguy 3y ago
  > I've never been convinced that saving a bit of log file space sigh It's not the log file space, it absence of failed attempts in the logs.
  - bigiain 3y ago
    Yep. Especially if there's a suspected incident or a new vulnerability announced, I'd much rather be reading port 2234 sshd logs that port 22 sshd logs - far less haystack to wade through looking for needles. And as another comment mentions, every time an sshd zero day is announced, pretty much the entire IPv4 address space gets probed on port 22 within about 30 minutes. A non standard port number _might_ buy you an extra hour or three if you've got a vulnerable sshd. But don't rely on that - someone's bound to have portscanned you recently enough and knows you've got OpenSSH_8.2p1 listening on port 2234 (or whatever) and they won't be far behind the whole-internet port 22 exploit probes.
- drpixie 3y ago
  I've certainly had lots of login probes at common non-standard ports - 22+n for easy to remember n. But it's nice to have the logs reasonably clean, makes it easier to see real problems.
- throw0101b 3y ago
  > I've never been convinced that saving a bit of log file space is worth the reconfiguration time […] This is relatively easy to do with Ansible (or whatever). My main concern as a sysadmin in a company is user training and telling folks to use the non-standard ports. If I could use SRV records for 'service (port) discovery' that'd be helpful.
rajamaka 3y ago
Kind of throwing the baby out with the bathwater no? Just block the ports/traffic and enjoy the convenience of DNS / signed certs.
nyanpasu64 3y ago
I think that requiring world-visible TLS certificates for LAN-local web services compromises the privacy of the infrastructure I run in my bedroom for my own usage.
- lysp 3y ago
  I use a wildcard for mine. *.locallan.domain.com It exposes part of the domain, but none of the services. If you want to be even more secure, you could null-IP the wildcard and only allocate IPs for subdomains that you use.

wrx100 3y ago

If you close all the ports you do not use and properly configure all services that listen on the ports that you do use, should you care? Should you bother with black holing, port knockers, non-standard port or even firewalls for that matter? Honest question

tsujamin 3y ago
Use one of the dial-outward mesh VPNs or authenticating proxies (Tailscale, MS AppProxy, CF Tunnels etc), block all incoming traffic and stop caring all together imo
jcrawfordor 3y ago
Probably not. This kind of scanning is essentially nuisance behavior. Like any nuisance, you could ignore it, or you could take action to suppress it. Where you land on that is largely personal opinion, but for a commercial project you should probably lean towards "ignoring" since any action against tends to create the possibility of false positives that affect customers. For personal use, I do feel that Wireguard or managed Wireguard setups like Tailscale are so easy to use that putting everything behind a VPN is cheap insurance and even convenient, since it takes care of NAT traversal for you.
bigiain 3y ago
For me at least, firewalls are worthwhile for "defence in depth". I may have closed off all services I'm not using, but a firewall will still help if I forget one or if I later accidentally start something that listens on a port. I also use blackholing (with fail2ban) and non standard ports (for ssh) - but just as a way to quiet down log files rather than ascribing much ion the way of security benefits to them.
- throw0101b 3y ago
  > I also use blackholing (with fail2ban) and non standard ports (for ssh) - but just as a way to quiet down log files rather than ascribing much ion the way of security benefits to them. Just switch to IPv6: good luck scanning a /64. :)

DeathArrow 3y ago

Can this port scanning be equivalent to a small DDOS. Wouldn't impact legitimate traffic?

willcipriano 3y ago
Not on anything bigger than a raspberry pi on a dial up connection, no.

redrove 3y ago

This is one of the reasons why I only use wildcard certs; yes, it’s security through obscurity to some extent, but it does work.

xg15 3y ago

The whole "the internet is a Dark Forest" hypothesis is kinda moot if you have industrial-strength floodlights like Certificate Transparency inbetween.

takinola 3y ago

This is nothing compared with how fast your email and phone numbers will be hammered as soon as you register a new domain.