5 ms·

I've seen MaxAuthTries used for similar reasons, and of course fail2ban, but this seems like a nice improvement and it's built in which is probably a win in thi

I've seen MaxAuthTries used for similar reasons, and of course fail2ban, but this seems like a nice improvement and it's built in which is probably a win in this case.

lxgr 2y ago
It does seem to be very similar in spirit and implementation: > PerSourceNetBlockSize > Specifies the number of bits of source address that are grouped together for the purposes of applying PerSourceMaxStartups limits. Values for IPv4 and optionally IPv6 may be specified, separated by a colon. The default is 32:128, which means each address is considered individually. Just like fail2ban, this seems like it can be equal parts helpful, a false sense of security, and a giant footgun. For example, allowing n invalid login attempts per time interval and (v4) /24 is not a big problem for botnet-based brute force attacks, while it's very easy for somebody to get unintentionally locked out when connecting from behind a CG-NAT.
- SoftTalker 2y ago
  ufw/iptables and other firewalls can also throttle repeated connection attempts, which is almost always fine but could be something you don't want if you have a legitmate need to support many rapid ssh connections from the same source (CM tools, maybe?)
  - yjftsjthsd-h 2y ago
    > if you have a legitmate need to support many rapid ssh connections from the same source (CM tools, maybe?) If you're doing that, I strongly suggest using ControlMaster to reuse the connections; it makes security tools like this less grumpy, but it's also a nice performance win.
    - aflukasz 2y ago
      Just remember that only first connection, the one creating ControlMaster socket, is being authenticated, subsequent ones are not.
  - megous 2y ago
    It's easy to do per source IP address and reasonably easy to add source IP address to whitelist automatically after successful auth.
tgv 2y ago
I managed one machine with such a mechanism, and I had to remove it, because it basically took all resources. I can't remember which daemon it was, but now the machine is only accessible from a limited set of ip addresses.
tomxor 2y ago
I've used fail2ban in production for many years but eventually removed it due to causing very large iptables leading high memory use and ultimately a source of instability for other services (i.e it turns into a DDoS vulnerability for the whole server). I know the usual advice then is to reduce ban time and just not have permabanning, but that seems to kind of defeat the purpose. I wonder how this SSH feature differs since it's implemented at the SSH level. So long as the SSH and or PAM config requires more than a password (I use hardware keys), the main concern to me is log noise (making it hard to identify targeted security threats) and SSH DDoS. I know tarpits and alternative ports are another way of dealing with that, but when SSH is used for many things having to change the port is kind of annoying. I think I'm probably just going to end up layering it like everyone else and stick everything behind a wireguard gateway, although that concept makes me slightly anxious about that single point of access failure.
- yjftsjthsd-h 2y ago
  > I've used fail2ban in production for many years but eventually removed it due to causing very large iptables leading high memory use and ultimately a source of instability for other services (i.e it turns into a DDoS vulnerability for the whole server). I know the usual advice then is to reduce ban time and just not have permabanning, but that seems to kind of defeat the purpose. Didn't the advice switch to using ipset a while back, precisely in the name of efficiency?
  - deleted 2y ago
    [deleted]
  - tomxor 2y ago
    Interesting thanks, I hadn't heard of that option.
- KennyBlanken 2y ago
  > causing very large iptables leading high memory use > I know the usual advice then is to reduce ban time and just not have permabanning, but that seems to kind of defeat the purpose. The purpose is to make random password attempts even more impractical. With even fairly lax fail2ban rules, it'll take multiple lifetimes to find a password made up of just two common use english words. However, that's not really their goal. I think that these SSH probes are mostly intended to find systems that have been compromised and have common backdoor passwords, though. ...and they use networks of zombie machines to do it. That's where stuff like Crowdsec and IP ban lists come in, with the side benefit of your IP addresses becoming less 'visible'

I've seen MaxAuthTries used for similar reasons, and of course fail2ban, but this seems like a nice improvement and it's built in which is probably a win in this case.

lxgr 2y ago

It does seem to be very similar in spirit and implementation: > PerSourceNetBlockSize > Specifies the number of bits of source address that are grouped together for the purposes of applying PerSourceMaxStartups limits. Values for IPv4 and optionally IPv6 may be specified, separated by a colon. The default is 32:128, which means each address is considered individually. Just like fail2ban, this seems like it can be equal parts helpful, a false sense of security, and a giant footgun. For example, allowing n invalid login attempts per time interval and (v4) /24 is not a big problem for botnet-based brute force attacks, while it's very easy for somebody to get unintentionally locked out when connecting from behind a CG-NAT.

SoftTalker 2y ago
ufw/iptables and other firewalls can also throttle repeated connection attempts, which is almost always fine but could be something you don't want if you have a legitmate need to support many rapid ssh connections from the same source (CM tools, maybe?)
- yjftsjthsd-h 2y ago
  > if you have a legitmate need to support many rapid ssh connections from the same source (CM tools, maybe?) If you're doing that, I strongly suggest using ControlMaster to reuse the connections; it makes security tools like this less grumpy, but it's also a nice performance win.
  - aflukasz 2y ago
    Just remember that only first connection, the one creating ControlMaster socket, is being authenticated, subsequent ones are not.
- megous 2y ago
  It's easy to do per source IP address and reasonably easy to add source IP address to whitelist automatically after successful auth.

tgv 2y ago

I managed one machine with such a mechanism, and I had to remove it, because it basically took all resources. I can't remember which daemon it was, but now the machine is only accessible from a limited set of ip addresses.

tomxor 2y ago

I've used fail2ban in production for many years but eventually removed it due to causing very large iptables leading high memory use and ultimately a source of instability for other services (i.e it turns into a DDoS vulnerability for the whole server). I know the usual advice then is to reduce ban time and just not have permabanning, but that seems to kind of defeat the purpose. I wonder how this SSH feature differs since it's implemented at the SSH level. So long as the SSH and or PAM config requires more than a password (I use hardware keys), the main concern to me is log noise (making it hard to identify targeted security threats) and SSH DDoS. I know tarpits and alternative ports are another way of dealing with that, but when SSH is used for many things having to change the port is kind of annoying. I think I'm probably just going to end up layering it like everyone else and stick everything behind a wireguard gateway, although that concept makes me slightly anxious about that single point of access failure.

yjftsjthsd-h 2y ago
> I've used fail2ban in production for many years but eventually removed it due to causing very large iptables leading high memory use and ultimately a source of instability for other services (i.e it turns into a DDoS vulnerability for the whole server). I know the usual advice then is to reduce ban time and just not have permabanning, but that seems to kind of defeat the purpose. Didn't the advice switch to using ipset a while back, precisely in the name of efficiency?
- deleted 2y ago
  [deleted]
- tomxor 2y ago
  Interesting thanks, I hadn't heard of that option.
KennyBlanken 2y ago
> causing very large iptables leading high memory use > I know the usual advice then is to reduce ban time and just not have permabanning, but that seems to kind of defeat the purpose. The purpose is to make random password attempts even more impractical. With even fairly lax fail2ban rules, it'll take multiple lifetimes to find a password made up of just two common use english words. However, that's not really their goal. I think that these SSH probes are mostly intended to find systems that have been compromised and have common backdoor passwords, though. ...and they use networks of zombie machines to do it. That's where stuff like Crowdsec and IP ban lists come in, with the side benefit of your IP addresses becoming less 'visible'