3 ms·
Port knocking with ssh over https using client certs. And port knocking is one of the few effective methods against the standard distributed brute forcing slow
by Joel_Mckay 3y ago
Port knocking with ssh over https using client certs.
And port knocking is one of the few effective methods against the standard distributed brute forcing slow attacks.
Note if you blanket-ban IN/RU/UK/CN/HK/TW/IR/MX/BZ/BA + tor/proxies lists, than 99.998% of your nuisance traffic issues disappear overnight. =)
- deknos 3y agocan you give an example for an implementation of portnocking/ssh/over https and client certs?
- Joel_Mckay 3y agoIn general, it is a standard shore-wall firewall rule in perl, and the standard ssh protocol wrapper mod. These are very well documented tricks, and when combined with a standard port 22 and interleaved knock ports tripwire 5 day ban rules... are quite effective against scanners too. I am currently on the clock, so can't write up a detailed tutorial right now. Best regards, =)
- oarsinsync 3y ago> if you blanket-ban IN/RU/UK/CN/HK/TW/IR/MX/BZ/BA The list of countries there: India, Russia, United Kingdom, China, Hong Kong, Taiwan, Iran, Mexico, Belize, Bosnia and Herzegovina I’m amused that the UK is in that group.
- Joel_Mckay 3y agoI was too, but the past few years their government server blocks have been pen-testing servers without authorization. It is apparently a free service they offer people even when told to get stuffed. =) My spastic ban-hammer active-response list i.e. the entire block gets temporarily black-holed with a single violation: AU BG BR BZ CN ES EE FR GB HR IL IN ID IR IQ JP KG KR KP KW LV MM MX NI NL PA PE PK PL RO RU RS SE SG TW TH TR YE VN UA ZA ZZ