5 ms·

Put a personal VPS (no domain) online today. Took like 10 seconds for the first ssh login attempts to start. It's toxic out there. I put everything behind wireg

by RGamma 2y ago

Put a personal VPS (no domain) online today. Took like 10 seconds for the first ssh login attempts to start. It's toxic out there. I put everything behind wireguard these days.

siamese_puff 2y ago
Same. Wireguard port and block the rest. Ez-Pz step 1 to take with minimal effort.
- kstrauser 2y ago
  I have a default-deny firewall in place, but this was on port 443 that I needed to have exposed already.
kijin 2y ago
I've had a dedicated server pwned before I even logged in for the first time. Somehow the attackers must have guessed the (purportedly random) initial root password, or exploited a vulnerability in the somewhat outdated OS image.
- getcrunk 2y ago
  If the host wasn’t some random cheap spot you HAVE to tell us who! (please :))
  - kijin 2y ago
    It was in South Korea. I don't want to blame the host because they were very quick to acknowledge the problem, which is something even well-known companies with worldwide presence tend not to be good at. They wiped the server and reinstalled a clean OS, free of charge, within hours.
nextaccountic 2y ago
> I put everything behind wireguard these days. What do you mean? You don't connect to ssh in the VPS directly, but through a VPN? How does this protects the VPS from attacks?
- alanfranz 2y ago
  You don’t bind the ssh port to the public internet.
  - nextaccountic 2y ago
    What about doing things like port knocking on non-standard ports? Exposing wireguard to the world isn't much better than exposing ssh
- paranoidrobot 2y ago
  If there isn't already, there needs to be something like the "Survivability Onion" from the Military[1], which has the first layer of the onion being: Don't Be There. For hosting, one of those layers is going to be: Don't expose ports publicly, if you don't want people connecting to them. Unless you're hosting a public SSH service, you shouldn't expose SSH on a public network. It protects the VPS from a few avenues of attack: - SSH vulnerabilities (either current, or because the server has not been updated regularly) - SSH server misconfiguration - Credentials leaked/stolen - Denial of Service (hammering SSH in an effort to either consume resources on the host, and make it harder to fix/patch an issue, or to force your hosting provider to block SSH) [1] https://en.wikipedia.org/wiki/Survivability#Military https://en.wikipedia.org/wiki/Survivability#Military (at the bottom of the section)
  - SahAssar 2y ago
    > SSH vulnerabilities OpenSSH is probably one of the most audited pieces of software running on your system. > SSH server misconfiguration Just like with TLS use tools to validate your config (like https://www.ssh-audit.com/ https://www.ssh-audit.com/) and you'll be mostly safe. > Denial of Service Usually it's easier to DoS whatever other service your server is running, like a web backend och mail server or similar. --- On the other hand you now need to manage two keys, the wireguard one and the SSH one, and you still need to expose your wireguard server (which is not necessarily more secure than OpenSSH). Just disable SSH password auth, run one of the ssh audit tools like the one I linked above and use hardware keys like the openssh yubikey feature (optional but nice to know that the key can't be cloned). If you really don't want people trying to ssh to you move it to another port or use port-knocking.
userbinator 2y ago
Known VPS IP ranges are going to be very heavily scanned.
mjrpes 2y ago
Yeah I've been happy with setting DHCP to internally resolve subdomains to local ip addresses, combined with a lets encrypt wildcard cert created with a DNS challenge. Everything secured behind WireGuard and you never for a second need to make your web services public.

by RGamma 2y ago

Put a personal VPS (no domain) online today. Took like 10 seconds for the first ssh login attempts to start. It's toxic out there. I put everything behind wireguard these days.

siamese_puff 2y ago

Same. Wireguard port and block the rest. Ez-Pz step 1 to take with minimal effort.

kstrauser 2y ago
I have a default-deny firewall in place, but this was on port 443 that I needed to have exposed already.

kijin 2y ago

I've had a dedicated server pwned before I even logged in for the first time. Somehow the attackers must have guessed the (purportedly random) initial root password, or exploited a vulnerability in the somewhat outdated OS image.

getcrunk 2y ago
If the host wasn’t some random cheap spot you HAVE to tell us who! (please :))
- kijin 2y ago
  It was in South Korea. I don't want to blame the host because they were very quick to acknowledge the problem, which is something even well-known companies with worldwide presence tend not to be good at. They wiped the server and reinstalled a clean OS, free of charge, within hours.

nextaccountic 2y ago

> I put everything behind wireguard these days. What do you mean? You don't connect to ssh in the VPS directly, but through a VPN? How does this protects the VPS from attacks?

alanfranz 2y ago
You don’t bind the ssh port to the public internet.
- nextaccountic 2y ago
  What about doing things like port knocking on non-standard ports? Exposing wireguard to the world isn't much better than exposing ssh
paranoidrobot 2y ago
If there isn't already, there needs to be something like the "Survivability Onion" from the Military[1], which has the first layer of the onion being: Don't Be There. For hosting, one of those layers is going to be: Don't expose ports publicly, if you don't want people connecting to them. Unless you're hosting a public SSH service, you shouldn't expose SSH on a public network. It protects the VPS from a few avenues of attack: - SSH vulnerabilities (either current, or because the server has not been updated regularly) - SSH server misconfiguration - Credentials leaked/stolen - Denial of Service (hammering SSH in an effort to either consume resources on the host, and make it harder to fix/patch an issue, or to force your hosting provider to block SSH) [1] https://en.wikipedia.org/wiki/Survivability#Military https://en.wikipedia.org/wiki/Survivability#Military (at the bottom of the section)
- SahAssar 2y ago
  > SSH vulnerabilities OpenSSH is probably one of the most audited pieces of software running on your system. > SSH server misconfiguration Just like with TLS use tools to validate your config (like https://www.ssh-audit.com/ https://www.ssh-audit.com/) and you'll be mostly safe. > Denial of Service Usually it's easier to DoS whatever other service your server is running, like a web backend och mail server or similar. --- On the other hand you now need to manage two keys, the wireguard one and the SSH one, and you still need to expose your wireguard server (which is not necessarily more secure than OpenSSH). Just disable SSH password auth, run one of the ssh audit tools like the one I linked above and use hardware keys like the openssh yubikey feature (optional but nice to know that the key can't be cloned). If you really don't want people trying to ssh to you move it to another port or use port-knocking.

userbinator 2y ago

Known VPS IP ranges are going to be very heavily scanned.

mjrpes 2y ago

Yeah I've been happy with setting DHCP to internally resolve subdomains to local ip addresses, combined with a lets encrypt wildcard cert created with a DNS challenge. Everything secured behind WireGuard and you never for a second need to make your web services public.