2 ms·
Who Is That Knocking at My (SSH) Door?
- comrade1234 6mo agoLot of words to write about something that has been happening for literally decades. You'll learn to ignore it like everyone else and just move on. Or even better, set up fail2ban with the recidive jail to at least reduce the size of your daily server report email.
- anygivnthursday 6mo agoOften enough to switch to a different port to drastically cut down the noise, most bots probe the defaults.
- tardedmeme 6mo agoOr use IPv6 - they'll never guess the address.
- voidUpdate 6mo agoI found it interesting. The part about the scripts trying "sheep" as the username was new to me. Not everybody knows everything, so it's nice to read a little article about new things
- iso1631 6mo agoI found it interesting but a honeypot would have been interesting -- how long do they spend trying passwords for example.
- tardedmeme 6mo agoAnd what are the passwords. And what percentage of IP addresses respond to those usernames and passwords.
- voidUpdate 6mo agoThe article linked at the top of TFA has all that sort of thing in it https://arman-bd.hashnode.dev/i-left-port-22-open-on-the-internet-for-54-days-here-s-who-showed-up https://arman-bd.hashnode.dev/i-left-port-22-open-on-the-int...
- iso1631 6mo agobehind a cloudflare block, not worth the fight
- voidUpdate 6mo agoDid you need to fight to pass the captcha? It let me in just fine
- drcongo 6mo agoIt's a magnificent article, it's well worth it.
- justsomehnguy 6mo agoxkcd 10000
- c0l0 6mo agoI recommend https://johannes.truschnigg.info/writing/2025-02-simple_effective_ssh_ratelimiting_pam_nftables/ https://johannes.truschnigg.info/writing/2025-02-simple_effe... as an (imo) better approach than fail2ban parsing your logs to deal with the problem.
- Meneth 6mo agoI got tired of dealing with SSH knocks and blocked the port for all external IPs, using WireGuard to get into the LAN. WireGuard is nice because, unlike most other services, it operates on UDP and sends no reply packet unless you know the key, so attackers can't discover it by portscanning.
- tardedmeme 6mo agoUnless all your other ports are sending reject packets
- yjftsjthsd-h 6mo agoDo UDP ports ever send reject packets?