4 ms·
I made my ssh server to listen ipv6-only, and it has been super silent in the logs ever since. In the first iteration the IPv6 got polled by a handful of attac
by happosai 2mo ago
I made my ssh server to listen ipv6-only, and it has been super silent in the logs ever since.
In the first iteration the IPv6 got polled by a handful of attackers as soon as the letsencrypt certificate was published. In the second iteration I just picked another IPv6 address from the /64 and made ssh.example.com to point to it. This should work until the attackers start guessing subdomain s...
- imoverclocked 2mo agoThis is an interesting piece that is often overlooked by folks in the "but NAT is security" camp; Having a sparse address space that is 64-bits makes it impossible to iteratively scan over a range. If you don't reverse resolve or you disallow zone transfers then you also have no real discoverability for that /64.
- happosai 2mo agoNobody allows zone transfers these days. But there is still the option for doing a dictionary attack on subdomains admin/ssh/console.example.com But yeah scanning IPv6 address space directly without DNS dictionary in hand is tough.