4 ms·

> With IPv6 on the other hand, it is trivially easy to get a new IP OpenSSH already seems to take that into account by allowing you to penalize not just a sing

by crote 2y ago

> With IPv6 on the other hand, it is trivially easy to get a new IP OpenSSH already seems to take that into account by allowing you to penalize not just a single IP, but also an entire subnet. Enable that to penalize an entire /64 for IPv6, and you're in pretty much the same scenario as "single IPv4 address". I think there's some limited value in it. It could be a neat alternative to allowlisting your own IP which doesn't completely block you from accessing it from other locations. Block larger subnets at once if you don't care about access from residential connections, and it would act as a very basic filter to make annoying attacks stop. Not providing any real security, but at least you're not spending any CPU cycles on them. On the other hand, I can definitely see CGNAT resulting in accidental or intentional lockouts for the real owner. Enabling it by default on all installations probably isn't the best choice.

janosdebugs 2y ago
IPv6 has the potential to be even worse. You could be knocking an entire provider offline. At any rate, this behavior should not become default.
aftbit 2y ago
FYI it's pretty common to get a /48 or a /56 from a data center, or /60 from Comcast.
- hot_gril 2y ago
  Maybe the only equivalent is to penalize a /32, since there are roughly as many of those as there are ipv4 addresses.
  - aftbit 2y ago
    My ISP has a /28 block, so if they chose to penalize my /32 for some reason, that would include 1/16th of the customers of my ISP. Just guessing based on population and situation, that might include on the order of 50000 people.
  - janosdebugs 2y ago
    That may be true mathematically, but there are no guarantees that a small provider won't end up having only a single /64, which would likely be the default unit of range-based blocking. Yes, it "shouldn't" happen.
    - hot_gril 2y ago
      Right. It's analogous to how blocking an ipv4 is unfair to smaller providers using cgnat. But if someone wants to connect to your server, you might want them to have skin in the game.
      - janosdebugs 2y ago
        The provider doesn't care, the owner of the server who needs to log in from their home internet at 2AM in an emergency cares. Bad actors have access to botnets, the server admin doesn't.
        hot_gril 2y ago
        Unfortunately the only answer is "pay to play." If you're a server admin needing emergency access, you or your employer should pay for an ISP that isn't using cgnat (and has reliable connectivity). Same as how you probably have a real phone sim instead of a cheap voip number that's banned in tons of places. Or better yet, a corp VPN with good security practices so you don't need this fail2ban-type setup. It's also weird to connect from home using password-based SSH in the first place.
        AnthonyMouse 2y ago
        The better answer is to just ignore dull password guessing attempts which will never get in because you're using strong passwords or public key authentication (right?). Sometimes it's not a matter of price. If you're traveling your only option for a network connection could be whatever dreck the hotel deigns to provide.
        2y ago
- dheera 2y ago
  I can never remember whether /x means "the last x bits are 0" or "the first x bits are 1" People should write 80/48 or 48/80 to be clear
  - patmorgan23 2y ago
    /x is almost always the number of network bits (so the first half). There are some Cisco ISO commands that are the opposite but those are by far the minority. 99/100 it means the first bits.
  - merlincorey 2y ago
    > I can never remember whether /x means "the last x bits are 0" or "the first x bits are 1" > People should write 80/48 or 48/80 to be clear The clarity is found implied in your preferred example. - "80/" would mean "80 bits before" - "/48" would mean "48 bits after"
    - dheera 2y ago
      ... and this is the opposite of the other 2 responses
  - immibis 2y ago
    It's not about how many bits are 1 - it's about how many bits are important. And the first bits are always most important. So it's the first x bits. If you have a /48 then 48 bits are used to determine the address is yours. Any address which matches in the first 48 bits is yours. If you have a /64, any address which matches in the first 64 bits is yours.
    - patmorgan23 2y ago
      It's about how many bits are 1, in the subnet mask.
      - immibis 2y ago
        The number of bits that are important is the number of 1 bits in the which bits are important mask, yes. I thought you couldn't remember how that mask worked.
- adraenwan 2y ago
  related: https://adam-p.ca/blog/2022/02/ipv6-rate-limiting/ https://adam-p.ca/blog/2022/02/ipv6-rate-limiting/

by crote 2y ago

janosdebugs 2y ago

IPv6 has the potential to be even worse. You could be knocking an entire provider offline. At any rate, this behavior should not become default.

aftbit 2y ago

FYI it's pretty common to get a /48 or a /56 from a data center, or /60 from Comcast.

hot_gril 2y ago
Maybe the only equivalent is to penalize a /32, since there are roughly as many of those as there are ipv4 addresses.
- aftbit 2y ago
  My ISP has a /28 block, so if they chose to penalize my /32 for some reason, that would include 1/16th of the customers of my ISP. Just guessing based on population and situation, that might include on the order of 50000 people.
- janosdebugs 2y ago
  That may be true mathematically, but there are no guarantees that a small provider won't end up having only a single /64, which would likely be the default unit of range-based blocking. Yes, it "shouldn't" happen.
  - hot_gril 2y ago
    Right. It's analogous to how blocking an ipv4 is unfair to smaller providers using cgnat. But if someone wants to connect to your server, you might want them to have skin in the game.
    - janosdebugs 2y ago
      The provider doesn't care, the owner of the server who needs to log in from their home internet at 2AM in an emergency cares. Bad actors have access to botnets, the server admin doesn't.
      - hot_gril 2y ago
        Unfortunately the only answer is "pay to play." If you're a server admin needing emergency access, you or your employer should pay for an ISP that isn't using cgnat (and has reliable connectivity). Same as how you probably have a real phone sim instead of a cheap voip number that's banned in tons of places. Or better yet, a corp VPN with good security practices so you don't need this fail2ban-type setup. It's also weird to connect from home using password-based SSH in the first place.
        AnthonyMouse 2y ago
        The better answer is to just ignore dull password guessing attempts which will never get in because you're using strong passwords or public key authentication (right?). Sometimes it's not a matter of price. If you're traveling your only option for a network connection could be whatever dreck the hotel deigns to provide.
        2y ago
dheera 2y ago
I can never remember whether /x means "the last x bits are 0" or "the first x bits are 1" People should write 80/48 or 48/80 to be clear
- patmorgan23 2y ago
  /x is almost always the number of network bits (so the first half). There are some Cisco ISO commands that are the opposite but those are by far the minority. 99/100 it means the first bits.
- merlincorey 2y ago
  > I can never remember whether /x means "the last x bits are 0" or "the first x bits are 1" > People should write 80/48 or 48/80 to be clear The clarity is found implied in your preferred example. - "80/" would mean "80 bits before" - "/48" would mean "48 bits after"
  - dheera 2y ago
    ... and this is the opposite of the other 2 responses
- immibis 2y ago
  It's not about how many bits are 1 - it's about how many bits are important. And the first bits are always most important. So it's the first x bits. If you have a /48 then 48 bits are used to determine the address is yours. Any address which matches in the first 48 bits is yours. If you have a /64, any address which matches in the first 64 bits is yours.
  - patmorgan23 2y ago
    It's about how many bits are 1, in the subnet mask.
    - immibis 2y ago
      The number of bits that are important is the number of 1 bits in the which bits are important mask, yes. I thought you couldn't remember how that mask worked.
adraenwan 2y ago
related: https://adam-p.ca/blog/2022/02/ipv6-rate-limiting/ https://adam-p.ca/blog/2022/02/ipv6-rate-limiting/