4 ms·

yup, something like spamd for ssh could be cool.. But evolving to crack other usernames and other ports is not so easy, and there's not even any incentive to d

by gizzlon 14y ago

yup, something like spamd for ssh could be cool.. But evolving to crack other usernames and other ports is not so easy, and there's not even any incentive to do that yet. "If your goal is to prevent your logs from being filled with crap, then changing ports won't solve the problem" ..Looking at my logs.. Yes, it did actually :) (edit: typo)

jcr 14y ago
I'm glad using an alternate port still works for you. On my home network, I lost my patience with the attacks a while ago and simply prevented sshd binding to the external interface of my firewall(s). Since I don't need external access to my home network, it was the easy way out. Some friends of mine run tunnelr.com where they run sshd on multiple ports, and they get hammered by attacks on a regular basis. Since they are a VPN service with tons of bandwidth, they're a prime target, and they get attacked on any port where sshd is running. It's a mess, and the approach that's working for you, doesn't work for them (and others I know). Just out of curiosity, and without naming any (domain) names, would you consider the systems where you're running on a nonstandard port to be "popular" or "high value" or "interesting" targets for attackers? (i.e. subjected to targeted attacks rather than just the typical bulk/blind/dumb attacks)?
- gizzlon 14y ago
  "Just out of curiosity, and without naming any (domain) names, would you consider the systems where you're running on a nonstandard port to be "popular" or "high value" or "interesting" targets for attackers? (i.e. subjected to targeted attacks rather than just the typical bulk/blind/dumb attacks)?" No, not at all. But remember what we are talking about here. You said moving ports is "pointless", and I argued that's it's not because it stops a lot of drive-by attacks. Instead of simply acknowledging this, you spent a lot of words arguing a straw-man.
  - jcr 14y ago
    Actually, I didn't intend to be argumentative, contradict you, use straw man nonsense, or try to convince you of anything. I'm sorry if it came across that way. What I'd like to do is just grasp the reason for the discrepancy between your experience and my own (and folks I know)? Obviously, changing ports works for you, and not for me, so I'm trying to figure out why. Maybe it's the type of sites you run, how you host them (racked, cloud, home, ...), upstream/provider filtering, where you're located, or something else?
    - gizzlon 14y ago
      My guess is just that my sites fly under the radar because they are unimportant, have little traffic etc.. But if people finds you random (not <1024) ssh port, they probably scanned all of you ports? Which seems drastic. Last time I checked, a few years ago, it was not normal to scan all the ports on a large block of IPs. Maybe that changed, but I have never seen that on the few machines and networks I can check. Anyway, my point is that targeted attacks is a another ballgame, but that does not make it pointless to protect against the dumb, automated attacks.

by gizzlon 14y ago

jcr 14y ago

I'm glad using an alternate port still works for you. On my home network, I lost my patience with the attacks a while ago and simply prevented sshd binding to the external interface of my firewall(s). Since I don't need external access to my home network, it was the easy way out. Some friends of mine run tunnelr.com where they run sshd on multiple ports, and they get hammered by attacks on a regular basis. Since they are a VPN service with tons of bandwidth, they're a prime target, and they get attacked on any port where sshd is running. It's a mess, and the approach that's working for you, doesn't work for them (and others I know). Just out of curiosity, and without naming any (domain) names, would you consider the systems where you're running on a nonstandard port to be "popular" or "high value" or "interesting" targets for attackers? (i.e. subjected to targeted attacks rather than just the typical bulk/blind/dumb attacks)?

gizzlon 14y ago
"Just out of curiosity, and without naming any (domain) names, would you consider the systems where you're running on a nonstandard port to be "popular" or "high value" or "interesting" targets for attackers? (i.e. subjected to targeted attacks rather than just the typical bulk/blind/dumb attacks)?" No, not at all. But remember what we are talking about here. You said moving ports is "pointless", and I argued that's it's not because it stops a lot of drive-by attacks. Instead of simply acknowledging this, you spent a lot of words arguing a straw-man.
- jcr 14y ago
  Actually, I didn't intend to be argumentative, contradict you, use straw man nonsense, or try to convince you of anything. I'm sorry if it came across that way. What I'd like to do is just grasp the reason for the discrepancy between your experience and my own (and folks I know)? Obviously, changing ports works for you, and not for me, so I'm trying to figure out why. Maybe it's the type of sites you run, how you host them (racked, cloud, home, ...), upstream/provider filtering, where you're located, or something else?
  - gizzlon 14y ago
    My guess is just that my sites fly under the radar because they are unimportant, have little traffic etc.. But if people finds you random (not <1024) ssh port, they probably scanned all of you ports? Which seems drastic. Last time I checked, a few years ago, it was not normal to scan all the ports on a large block of IPs. Maybe that changed, but I have never seen that on the few machines and networks I can check. Anyway, my point is that targeted attacks is a another ballgame, but that does not make it pointless to protect against the dumb, automated attacks.