7 ms·
I have my own system of IP reputation whereby if an IP address hits one of my systems with some probe or scan that I didn't ask for, then it's blocked for 12 mo
by BLKNSLVR 8mo ago
I have my own system of IP reputation whereby if an IP address hits one of my systems with some probe or scan that I didn't ask for, then it's blocked for 12 months.
https://github.com/UninvitedActivity/UninvitedActivity https://github.com/UninvitedActivity/UninvitedActivity
P.S. just to add a note here that I have been blocked out of my own systems occasionally from mobile / remote IPs due to my paranoia-level setup. But I treat that as learning / refinement, but also can accept that as the cost of security sometimes.
- observationist 8mo agoNice, thanks for the link. Good to be ruthless about those things when you can.
- Latty 8mo agoMy first thought is that with CGNAT ever more present, this kind of approach seems like it'll have a lot of collateral damage.
- BLKNSLVR 8mo agoYeah, my setup is purely for my own security reasons and interests, so there's very little downside to my scorched earth approach. I do, however, think that if there was a more widespread scorched earth approach then the issues like those mentioned in the article would be much less common.
- lxgr 8mo agoIn such a world you can say goodbye to any kind of free Wi-Fi, anonymous proxy etc., since all it would take to burn an IP for a year is to run a port scan from it, so nobody would risk letting you use theirs. Fortunately, real network admins are smarter than that.
- deleted 8mo ago[deleted]
- BLKNSLVR 8mo agoPretty much. I think there's also a responsibility on the part of the network owner to restrict obviously malicious traffic. Allow anonymous people to connect to your network and then perform port scans? I don't really want any traffic from your network then. Yes, there are less scorched-earth ways of looking at this, but this works for me. As always, any of this stuff is heavily context specific. Like you said: network admins need to be smart, need to adapt, need to know their own contexts.
- gzread 8mo agoDo you feel coffee shop WiFi should require you to scan your passport to connect, or that it shouldn't exist at all?
- perching_aix 8mo agoNot OP, but the latter sounds pretty good actually, yeah. Never understood the free WiFi craze anyways. Just use cellular?
- gzread 8mo agoAnd you should require your passport to get one of those?
- perching_aix 8mo agoID card you mean ;)) Yes, and we already do.
- lxgr 8mo agoWhat an incredibly short-sighted, dystopian view. I live in a country that has mandatory SIM registration, and it's stopping exactly zero organized criminals – these can just pay a tiny bit more and buy burner phones and use out-of-country SIM cards – while it's making life more complicated and expensive for the average citizen. Expensive because KYC isn't cheap, and guess who pays for that in the end... And that is assuming that your form of ID is even accepted as a foreigner. In a different country, I literally just spent two days sending back and forth selfies holding my passport(!) to little success. And I guess the customer support reps could now just use the same photos to impersonate me elsewhere, since passport photos provide absolutely zero domain binding and are just about the dumbest thing still seeing widespread adoption. I don't often use registration-free public Wi-Fis, but I love that they exist, and I would hate if they'd be taken away too. I also just transited at an airport that requires passport scans for Wi-Fi usage, and it feels so backwards. Thanks for being honest about this, though. I was always wondering who all these people were that are seriously in favor of all this dystopian stuff. Would love to hear why you think that it's a net positive for society.
- Gigachad 8mo agoIf you actually wanted your site or service to be accessible you’d run in to issues immediately since once IP would have cycled between hundreds of homes in a year. IP based bans have long been obsolete.
- gnabgib 8mo agoNo, no they haven't. A bad behaving network still has to answer to 2-3 bad IPs, and if it doesn't.. it's obsolete. https://news.ycombinator.com/item?id=47246044 https://news.ycombinator.com/item?id=47246044
- Borg3 8mo agoHaha, nice, I run something similar.. But more manualy managed and I put those bans pernametly. Currneltly, there are 1360 blocks in drop list and growing. I never really remove them, because even those leased blocks move from one spam/abuse operator to another, so no big loss. And indeed, if people would fight w/ spam/abuse better and more aggresivly, the problem would be much smaller. I dont care anymore, In my opinion Internet is done. Time to start building overlay networks with services for good guys...
- abofh 8mo agoFor people that implement it there's less than three people who use it, or agencies supporting it
- gzread 8mo agoCGNAT? That's definitely not true. There are whole towns that have to share one IP address. They're mostly in the third world.
- kevin_thibedeau 8mo agoI perma-ban any /16 that hits fail2ban 100+ times. That cuts down dramatically on the attacks from the usual suspects.
- BLKNSLVR 8mo agoI haven't manually reviewed my lists for a while, but I did similar checks for X IP addresses detected from within a /24 block to determine whether I should just block the whole /24. Manual reviewing like this also helped me find a bunch of organisations that just probe the entire IPv4 range on a regular basis, trying to map it for 'security' purposes. Fuck them, blocked! P.S. I wholeheartedly support your choice of blocking for your reasons.
- kees99 8mo ago> bunch of organisations that just probe the entire IPv4 range on a regular basis Yep, #1 source of junk traffic, in my experience. I set those prefixes go right into nullroute on every server I set up: https://raw.githubusercontent.com/UninvitedActivity/UninvitedActivity/main/02_InternetScanners/02_ZZInternetScannersSingleList.txt https://raw.githubusercontent.com/UninvitedActivity/Uninvite... #2 are IP ranges of Azure, DO, OVH, vultr, etc... A bit harder to block those outright.
- miyuru 8mo agoIn my servers I dont have IPv4 at all, just IPv6 only. On the plus side, it does not waste CPU cycles used to block unwanted IPv4 traffic.
- kees99 8mo agoThat helps a bit, true. But not that much, unfortunately. Those same "cYbeRseCUrITy" orgs also ingest SSL transparency logs, resolve A and AAAA for all the names in the cert, then turn around and start scanning those addresses. In my experience, it only takes a few hours from getting an SSL certificate to junk traffic to start rolling in, even for IPv6-only servers. Small percentage of that could be attributed directly, based on "BitSightBot", "CMS-Checker", "Netcraft Web Server Survey", "Cortex-Xpans" and similar keywords in user-agent and referer headers. And purely based on timing, there's a lot more of that stuff where scanners try and blend in.
- paulddraper 8mo agoHow often do you ask for probes or scans?
- deleted 8mo ago[deleted]
- BLKNSLVR 8mo agoDo you have two middle initials, both starting with d?
- paulddraper 8mo agoLike most people, I have one middle initial.
- BLKNSLVR 8mo agoApologies, bad joke. I thought the context was good enough.
- ronsor 8mo ago> can accept that as the cost of security sometimes And corporate IT wonders why employees are always circumventing "security policies"...
- BLKNSLVR 8mo agoAdditional explanation: this is primarily a personal setup. There would be a lot of refinement and contingencies to implement something like this for corporate / business. Having said that, I still exist on the ruthless side of blocking equation. I'd generally prefer some kind of small allow list than a gigantic block list, but this is how it's (d)evolved.
- cortesoft 8mo agoHow is this better than blocking after a certain quantity in a range of time instead? Single queries should never be harmful to something openly accessible. DOS is the only real risk, and blocking after a certain level of traffic solves that problem much better with less possibility of a false positive, and no risk to your infrastructure, either.
- deleted 8mo ago[deleted]