3 ms·

Good grief. A couple days ago I re-enabled password logins on a server that normally only accepts private keys, just to check something from a third location, a

Good grief. A couple days ago I re-enabled password logins on a server that normally only accepts private keys, just to check something from a third location, and then forgot to turn it off. Two days later the server's logs were full of thousands of failed login attempts that started a few hours after I enabled passwords and then ramped up to dozens per minute. Just because it didn't instantly say "Goodbye". I checked ip locations on the biggest offensing addresses; all were in China. I don't know what to call the idiocy and amorality that leads people to scan port 22 for a living (or the stupidity that leads them to guess random passwords for random usernames that don't exist), but I suppose that for every gardener there are a billion ants.

p_l 2y ago
There's a cottage industry of shitty mass-scanning attacks that continue onto getting root on badly setup fresh installs of various linux distros and drop a rootkit on them. Some other common targets are websites to be reused for spam (hello, Wordpress!) or to hijack things like gitlab (again to drop a rootkit. The rootkits are then usually used either for DDoS extortion rackets (usually against game servers, including online gambling), spam (might be less big today than it used to be), and cryptocurrency mining (from my experience mainly monero). One time it happened in a network I set up due to miscommunication and misunderstanding of how vendor's install scripts worked (by vendor technicians!). During investigation, we found out that this particular "kit" was sold cheaply on a chinese forum (used to be russian forums back in the day, eh), as complete package to run on Windows to attack linux hosts for DDoS botnet purposes.
beastman82 2y ago
The name for it is "authoritarian government"
mmcnl 2y ago
I have SSH access to my server behind a VPN. Not opening port 22 makes life a lot easier.
jimbobthrowawy 2y ago
I always install fail2ban or something like it on servers I want to have SSH on. Really cuts down on the log volume, even if I have locked myself out occasionally. The thing about port scanning is that it's cheap as hell. There's less than 4 billion IP4 addresses and zmap can hit them all within an hour on a decent network connection.

p_l 2y ago

There's a cottage industry of shitty mass-scanning attacks that continue onto getting root on badly setup fresh installs of various linux distros and drop a rootkit on them. Some other common targets are websites to be reused for spam (hello, Wordpress!) or to hijack things like gitlab (again to drop a rootkit. The rootkits are then usually used either for DDoS extortion rackets (usually against game servers, including online gambling), spam (might be less big today than it used to be), and cryptocurrency mining (from my experience mainly monero). One time it happened in a network I set up due to miscommunication and misunderstanding of how vendor's install scripts worked (by vendor technicians!). During investigation, we found out that this particular "kit" was sold cheaply on a chinese forum (used to be russian forums back in the day, eh), as complete package to run on Windows to attack linux hosts for DDoS botnet purposes.

beastman82 2y ago

The name for it is "authoritarian government"

mmcnl 2y ago

I have SSH access to my server behind a VPN. Not opening port 22 makes life a lot easier.

jimbobthrowawy 2y ago

I always install fail2ban or something like it on servers I want to have SSH on. Really cuts down on the log volume, even if I have locked myself out occasionally. The thing about port scanning is that it's cheap as hell. There's less than 4 billion IP4 addresses and zmap can hit them all within an hour on a decent network connection.