7 ms·
Some thoughts on OpenSSH 9.8's PerSourcePenalties feature
- PreInternet01 2y agoPerSourcePenalties-like abuse mitigations are not very subtle, but often very effective. My own experience with this is not as much with SSH as with SMTP. If your particular IP emits a single non-deliverable message every 30 minutes or so, that's fine. But: more than a handful of SPF failures for the same sender/recipient combo within 10 minutes or so? Yeah, you're now on the general-deny-list. And persisting even then? Automagically tar-pitted on the firewall, and have fun...
- HL33tibCe7 2y ago> But: more than a handful of SPF failures for the same sender/recipient combo within 10 minutes or so? Yeah, you're now on the general-deny-list. And persisting even then? Automagically tar-pitted on the firewall, and have fun... What is the advantage of bothering to do this? To me, it seems like you're risking blocking legitimate traffic (as two obvious examples, in cases where a sending mailserver is temporarily misconfigured, or if a malicious mailserver is using a cloud IP that is later recycled to a completely unrelated user), for basically zero upside.
- PreInternet01 2y ago> What is the advantage of bothering to do this? For SMTP: log optimization. Like: yeah, I don't care that you're self-DDOSing if you're an actual spammer. But, just in case you're a legitimate sender lacking SPF records, and you just need some help, I still want some kind of signal. For SSH, I guess you might want something similar, just to catch authorized-yet-misconfigured remotes...
- mdtancsa 2y agoI suspect the distributed cracking will move to the same pattern as the SMTP/pop3 brute force guys did and use one IP per x+1 seconds where x=the ssh penalty window. We have seen this on our customer facing smtp server where we have hundreds of remote compromised IPs trying each one password per 30-60min. Still, I welcome this change as there are enough single prick attackers out there where this will help cut down on the size of the logs to process / digest.
- catkitcourt 2y agoActually this already is the SOTA of cracking. My honeypot can see several different IP is brute forcing concurrently, and they seems irrelevant. But once you let one of them login, it will quit immediately and all those IPs will quiet after ~15sec. Then one of those IPs will login again to deploy miner.
- superjan 2y agoNext level: let them login and forward the ssh connection to the digital equivalent of a room full of mirrors.
- spogbiper 2y agoreminds me of using the old MIRROR target in iptables back in the day. before it was removed because its ridiculous. we used to watch script kiddies trying to brute force their own hosts but even then we knew it was ripe for abuse. https://www.linuxtopia.org/Linux_Firewall_iptables/x4448.html https://www.linuxtopia.org/Linux_Firewall_iptables/x4448.htm...
- snvzz 2y agoIt was beautiful to see people nuke themselves in winnuke era.
- Terr_ 2y agoProbably for the best, since it sounds like that could be used for DDoS amplification and/or reflection. For example, if an attack could spoof traffic to get two different reflectors hall-of-mirror-ing each other, or using a botnet that spoofs traffic to get one collection of dupes to slam a single victim in response, etc.
- metadat 2y agoHow would you spoof multiple valid packets in a TCP-based protocol requiring a sequence of interactions when you can't receive any of the ACKs (because they'll be sent to not-your-IP)?
- WhatIsDukkha 2y agoI wish the openssh folks would implement a UDP based "whole auth key or no talk at all" protocol. ie Single Packet Authorization Wrapping your ssh with wireguard (because wireguard doesn't respond without a full key) doesn't feel too good.
- rwmj 2y agoI've not used it, but this ssh wrapper was mentioned here a few days ago: https://github.com/mrash/fwknop https://github.com/mrash/fwknop
- tptacek 2y agoWhy? What does that get you?
- cedws 2y agoI’ve been thinking that we need a new ‘WireGuard of SSH’ for a while. SSH is such a complex behemoth now. Before WireGuard came along VPNs were horrible to work with, the cryptography was bad and they were too configurable. Just do one thing and do it well - provide a way to establish an encrypted remote shell. Let others build on top of that if they need more. Vulnerabilities lurk in overly complex software with a thousand bells and whistles. By reducing the code paths you’re making software that is much easier to audit and fuzz.
- tptacek 2y agoI agree directionally, but the frankly stunning security track record of OpenSSH makes that a hard argument to really prosecute.
- mmooss 2y agoI'm curious about what works and what doesn't: Many experts don't trust OpenBSD's security implementation (I don't want to raise the issue, just stating fact - many don't). Yet many do trust OpenSSH's security implementation, and OpenSSH is of course an OpenBSD project. What works in OpenSSH that doesn't work in OpenBSD? Maybe it's as simple as, though under the same umbrella OpenSSH uses a different team, methodology, etc.
- catkitcourt 2y agoWhat’s the difference between fail2ban? Though I feel neither of those two works now.
- kemitche 2y agoSeems similar, except that this is built-in to sshd vs having to install a separate tool. It's also enabled by default here in sshd.
- niobe 2y agofail2ban works just fine with sshd. I combine this GeoIP blocking ceetain troublesome locations in firewalls. 98% of my scanning / exploiting comes from 11 countries.
- bigiain 2y agofail2ban is great, but only works on the local host. The post says: "Right now our perimeter firewall is blind to whether a brief SSH connection was successful or not" (I suspect there's a way to set up centralised logging and fail2ban running looking at those centralised logs and sending updates to a perimeter firewall, but that's not a typical deployment of fail2ban. Or at least is wasn't when I was heavily using it a while back.)
- bbayles 2y agoHow about a service that lets bruteforcers "in" after some number of failed attempts, but what they get is just a fake command prompt that accepts all of their commands? I'm sure hackers would eventually adapt, but it would annoy them for a while.
- mikedelfino 2y agoI can't tell if that's sarcasm, but that's a thing already, called honey pot. Very often, you set it up to let attackers in so you can analyze what they're doing and protect yourself better.
- teruakohatu 2y agoThey would just connect, issue some command like ‘ls’ and evaluate the response, not sure that would slow them down much more than they already are.
- mmsc 2y agothe future is bleak: Attackers can just rent a /48 ipv6 block for a few dollars and have a billion IPs at their disposal.
- vetrom 2y agoIt's certainly an annoying future. I fully expect some sort of ASN-reputation map and service to become de rigeur in the next decade. Pretty sure heavier-duty SIEM/IPS systems already do that.
- kemitche 2y agoYou can control the block size for this, though: https://man.openbsd.org/sshd_config.5#PerSourceNetBlockSize https://man.openbsd.org/sshd_config.5#PerSourceNetBlockSize
- tsimionescu 2y agoI'm sure people will quickly start blocking /48s or even larger blocks once that becomes common.
- gnfargbl 2y agoThey already do. The IPv6 public routable prefix is the first 48 bits, so a /48 is what ~everyone uses as the analogy of the v4 /32, for rate limiting purposes.
- lxgr 2y agoEveryone? I’ve had ISPs provide me with anything from an /48 to a /64. For the latter, you’d be vastly over counting with /48-based limiting.
- Sesse__ 2y agoBut the /64 would not be publicly routable (i.e., be visible in the global BGP table). I guess in practice, it's more like IPv4 /24 = IPv6 /48, though. The closest analog to an IPv4 /32 would probably be an IPv6 /64.
- jijji 2y agoI usually just IP whitelist inbound sshd connections and then drop all other packets
- kkfx 2y agoHem... There is PerSourcePenaltyExemptList to whitelist specific hosts so while I agree it might create a bit more complexity (not much different than handling fail2ban and co) it's not "blocking" like described.
- mscdex 2y agoFor what it's worth if you have control over both client and server and don't want to limit access using a strict IP whitelist, an alternative solution that will keep your logs quieter and add additional protection is to use good old fashioned port knocking. knockd on Linux helps with automating this on the server side. Client side you can use anything (although knockd does include a dedicated client) to send your sequence of packets before actually connecting.
- gnfargbl 2y agoI really think this solution is underrated. Port knocking is robust, doesn't use any special technology, and servers using it can't reasonably be scanned for. The only real disadvantage is that any passive observer can see your knock sequence in "plaintext" (so that includes anyone logging netflow). Even so, I don't know why OpenSSH hasn't implemented it instead of the the silly fail2ban theatre we're discussing in these comments.
- ikiris 2y agoBecause it's a stupid low entropy key put in front of a service that you should be using MUCH harder keys on instead of passwords as of circa the 90s. You're wanting to add a screen door on a sub, and its just a feel good option for those who don't understand the math involved. The proper solution is to stop using passwords and use keys or proper cert auth.
- mscdex 2y agoI think it goes without saying that you would still want to be using keys instead of passwords for the actual authentication. Port knocking should always be an additional layer, not a replacement layer.
- imglorp 2y agoOne thing to help with the passive observer would be to have the knock sequence be time varying like a TOTP. It's still a very thin addition but more defense in depth the better sometimes.
- jms703 2y agoIf you must expose SSH to the internet, this can be a helpful feature.
- djbusby 2y agoThis thread has some mentions of memory-safe issues. Has anyone tried a Go or Rust sshd in their production? I've had some dreams of a "tighter" sshd for my universe and have toyed (unsuccessfully) with a Go one. Anyone want to share their experience?