5 ms·
DDoS attack on your sshd?
by bradknowles 3y ago
DDoS attack on your sshd?
- indigodaddy 3y agoOne option could be to lock the port down to only your jump/bastion server source IP.
- bradknowles 3y agoThat fails to when you lose that IP address, or you lose that server.
- indigodaddy 3y agoI suppose if you don’t have console access, sure. But inconvenient at worst imv.
- bradknowles 3y agoIf you have a way around that bastion server, then at least you've got a backup. But then you also have to worry about the security of that backup.
- PLG88 3y agoYes, better to make your bastion 'dark' without being tied to an IP address. This is how we do it at my company with the open source tech we have developed - https://netfoundry.io/bastion-dark-mode/ https://netfoundry.io/bastion-dark-mode/
- psanford 3y agoAre we just speculating? SSH scanners are not sources of DDoS. Large companies have ssh bastions on the internet and do not worry about ssh DDoS. Its not really a thing that happens. You don't need to freak out if you see a bunch of failed ssh auth attempts in your logs. Just turn off password based authentication and rest easy.
- koito17 3y agoAgreed. Another thing you can do to drastically reduce the amount of bots hitting your sshd is to listen on a port that is not 22. In my experience, this reduces ~90% of the clutter in my logs. (Disclaimer: this may not be the case for you or anyone else)
- TacticalCoder 3y agoJust to reduce the crap in the log and also because I can, I have my SSH servers (not saying what their IPs are) using a very effective measure: traffic is dropped from the entire world, except for the CIDR blocks, which I put in ipsets, of the five ISPs over three countries I could reasonably be in when I need to access the SSH servers. And if I'm really, say, in China or Russia an really need to access one of my servers through SSH, I can use a jump host in one of the three countries that I allow. So effectively: DROPping traffic from 98% of the planet. Boom.
- bradknowles 3y agoDeny by default, allow only those sources that are considered trustworthy. And frequently re-evaluate who and what should be considered trustworthy.
- aborsy 3y agoOr close the ports, and install an agent that phones out such as Tailscale or twingate.
- Fnoord 3y agoOr just Wireguard itself.
- PLG88 3y agoThis is the way, outbound only connections so you can stop all external unauthenticated attacks. I wrote a blog 2 years back comparing zero trust networking using Harry Potter analogies... what we are describing is making our resources 'invisible' to silly muggles - https://netfoundry.io/demystifying-the-magic-of-zero-trust-with-my-daughter-and-opensource/ https://netfoundry.io/demystifying-the-magic-of-zero-trust-w...