5 ms·

Colin, I've always thought of running SSH on some other port as the equivalent of painting your front door camouflage with the hope attackers might overlook it

by jcr 14y ago

Colin, I've always thought of running SSH on some other port as the equivalent of painting your front door camouflage with the hope attackers might overlook it -- in other words, pointless. It might stop some of the "log spam" from dumb brute force attacks on port 22, but if a port scan was done to find the sshd listening port (i.e. a smart attacker), then you still get attacked and log spammed. As far as I know, this issue is best handled by pf. I'm probably missing something obvious, but I don't understand how spipe/spiped on another port fixes (or helps) the brute force problem?

cperciva 14y ago
People can connect to spiped, but nothing will go through to sshd unless they can complete the handshake (which requires an unfeasible amount of work unless the person connecting holds the spiped secret).
- jcr 14y ago
  Interesting. I'll check it out. Thanks! I've always wanted something like spamd(8) for ssh, so everyone who normally blocks inbound port 22 can work together to thwart the brute force attacks by providing a honeypot/sandtrap/tarpit for the attack scripts to waste all of their time and resources.
gizzlon 14y ago
"in other words, pointless. It might stop some of the "log spam".." You kind-of contradicted yourself in four words there.. Afaik, it stops the most common "attacks", the automated drive-by password-guessing attacks. Far from pointless.
- jcr 14y ago
  I can see your point but you're not looking at the problem realistically; dumb attack tools get smarter over time. Let's say a dumb attack tool tries to access the root account over ssh on port 22. If enough people disable root ssh access or stop running ssh on port 22, then you should expect the attack tools to evolve (and yes, they have) to trying other accounts and other ports. The end result is your logs still get filled with crap. If your goal is to prevent your logs from being filled with crap, then changing ports won't solve the problem. Personally, I don't know of a working solution to prevent ssh brute force attacks from filling up our logs with crap, but something like spamd(8) for sshd might make the attackers give up (or at least learn to leave the people running it alone). http://www.openbsd.org/spamd/ http://www.openbsd.org/spamd/ http://www.openbsd.org/cgi-bin/man.cgi?query=spamd&sektion=8 http://www.openbsd.org/cgi-bin/man.cgi?query=spamd&sekti... http://www.openbsd.org/cgi-bin/man.cgi?query=spamd-setup&sektion=8 http://www.openbsd.org/cgi-bin/man.cgi?query=spamd-setup&#38... The goal of spamd(8) is making it painful, slow, and expensive for spammers while keeping mail services running. It seems Colin is headed in a vaguely similar direction with spipe/spiped albeit without the intentionally sadistic tar-pitting and stuttering of spamd(8).
  - gizzlon 14y ago
    yup, something like spamd for ssh could be cool.. But evolving to crack other usernames and other ports is not so easy, and there's not even any incentive to do that yet. "If your goal is to prevent your logs from being filled with crap, then changing ports won't solve the problem" ..Looking at my logs.. Yes, it did actually :) (edit: typo)
    - jcr 14y ago
      I'm glad using an alternate port still works for you. On my home network, I lost my patience with the attacks a while ago and simply prevented sshd binding to the external interface of my firewall(s). Since I don't need external access to my home network, it was the easy way out. Some friends of mine run tunnelr.com where they run sshd on multiple ports, and they get hammered by attacks on a regular basis. Since they are a VPN service with tons of bandwidth, they're a prime target, and they get attacked on any port where sshd is running. It's a mess, and the approach that's working for you, doesn't work for them (and others I know). Just out of curiosity, and without naming any (domain) names, would you consider the systems where you're running on a nonstandard port to be "popular" or "high value" or "interesting" targets for attackers? (i.e. subjected to targeted attacks rather than just the typical bulk/blind/dumb attacks)?
      - gizzlon 14y ago
        "Just out of curiosity, and without naming any (domain) names, would you consider the systems where you're running on a nonstandard port to be "popular" or "high value" or "interesting" targets for attackers? (i.e. subjected to targeted attacks rather than just the typical bulk/blind/dumb attacks)?" No, not at all. But remember what we are talking about here. You said moving ports is "pointless", and I argued that's it's not because it stops a lot of drive-by attacks. Instead of simply acknowledging this, you spent a lot of words arguing a straw-man.
        jcr 14y ago
        Actually, I didn't intend to be argumentative, contradict you, use straw man nonsense, or try to convince you of anything. I'm sorry if it came across that way. What I'd like to do is just grasp the reason for the discrepancy between your experience and my own (and folks I know)? Obviously, changing ports works for you, and not for me, so I'm trying to figure out why. Maybe it's the type of sites you run, how you host them (racked, cloud, home, ...), upstream/provider filtering, where you're located, or something else?

by jcr 14y ago

cperciva 14y ago

People can connect to spiped, but nothing will go through to sshd unless they can complete the handshake (which requires an unfeasible amount of work unless the person connecting holds the spiped secret).

jcr 14y ago
Interesting. I'll check it out. Thanks! I've always wanted something like spamd(8) for ssh, so everyone who normally blocks inbound port 22 can work together to thwart the brute force attacks by providing a honeypot/sandtrap/tarpit for the attack scripts to waste all of their time and resources.

gizzlon 14y ago

"in other words, pointless. It might stop some of the "log spam".." You kind-of contradicted yourself in four words there.. Afaik, it stops the most common "attacks", the automated drive-by password-guessing attacks. Far from pointless.

jcr 14y ago
I can see your point but you're not looking at the problem realistically; dumb attack tools get smarter over time. Let's say a dumb attack tool tries to access the root account over ssh on port 22. If enough people disable root ssh access or stop running ssh on port 22, then you should expect the attack tools to evolve (and yes, they have) to trying other accounts and other ports. The end result is your logs still get filled with crap. If your goal is to prevent your logs from being filled with crap, then changing ports won't solve the problem. Personally, I don't know of a working solution to prevent ssh brute force attacks from filling up our logs with crap, but something like spamd(8) for sshd might make the attackers give up (or at least learn to leave the people running it alone). http://www.openbsd.org/spamd/ http://www.openbsd.org/spamd/ http://www.openbsd.org/cgi-bin/man.cgi?query=spamd&sektion=8 http://www.openbsd.org/cgi-bin/man.cgi?query=spamd&sekti... http://www.openbsd.org/cgi-bin/man.cgi?query=spamd-setup&sektion=8 http://www.openbsd.org/cgi-bin/man.cgi?query=spamd-setup&#38... The goal of spamd(8) is making it painful, slow, and expensive for spammers while keeping mail services running. It seems Colin is headed in a vaguely similar direction with spipe/spiped albeit without the intentionally sadistic tar-pitting and stuttering of spamd(8).
- gizzlon 14y ago
  yup, something like spamd for ssh could be cool.. But evolving to crack other usernames and other ports is not so easy, and there's not even any incentive to do that yet. "If your goal is to prevent your logs from being filled with crap, then changing ports won't solve the problem" ..Looking at my logs.. Yes, it did actually :) (edit: typo)
  - jcr 14y ago
    I'm glad using an alternate port still works for you. On my home network, I lost my patience with the attacks a while ago and simply prevented sshd binding to the external interface of my firewall(s). Since I don't need external access to my home network, it was the easy way out. Some friends of mine run tunnelr.com where they run sshd on multiple ports, and they get hammered by attacks on a regular basis. Since they are a VPN service with tons of bandwidth, they're a prime target, and they get attacked on any port where sshd is running. It's a mess, and the approach that's working for you, doesn't work for them (and others I know). Just out of curiosity, and without naming any (domain) names, would you consider the systems where you're running on a nonstandard port to be "popular" or "high value" or "interesting" targets for attackers? (i.e. subjected to targeted attacks rather than just the typical bulk/blind/dumb attacks)?
    - gizzlon 14y ago
      "Just out of curiosity, and without naming any (domain) names, would you consider the systems where you're running on a nonstandard port to be "popular" or "high value" or "interesting" targets for attackers? (i.e. subjected to targeted attacks rather than just the typical bulk/blind/dumb attacks)?" No, not at all. But remember what we are talking about here. You said moving ports is "pointless", and I argued that's it's not because it stops a lot of drive-by attacks. Instead of simply acknowledging this, you spent a lot of words arguing a straw-man.
      - jcr 14y ago
        Actually, I didn't intend to be argumentative, contradict you, use straw man nonsense, or try to convince you of anything. I'm sorry if it came across that way. What I'd like to do is just grasp the reason for the discrepancy between your experience and my own (and folks I know)? Obviously, changing ports works for you, and not for me, so I'm trying to figure out why. Maybe it's the type of sites you run, how you host them (racked, cloud, home, ...), upstream/provider filtering, where you're located, or something else?