3 ms·
> The vast majority of sites don't get constantly hammered by attackers looking for a way in I find that hard to believe really. Even just my residential conn
by nwh 13y ago
> The vast majority of sites don't get constantly hammered by attackers looking for a way in
I find that hard to believe really.
Even just my residential connections honeypot is stuffed with people trying to do obscenely stupid things. There's people installing botnet clients, trying to find databases, you name it. I get a connect every couple of hours, and there's absolutely nothing else interesting about the IP address other than the single open port. Funnily enough, most of them fall into the "Chinese hacker" stereotype, about 90% of the connections I've logged geolocate there.
I can't imagine what a large companies SSH logs must look like.
- peterwwillis 13y agoYour expectations are based on a completely different scenario. A honeypot is designed to attract attackers, and is designed with bad security in mind. No corporate network runs SSH in the open. There's no need. What a corporate network needs is to provide remote access to specific services based on who is authorized. A VPN is the way to accomplish this. It would be stupid to allow SSH access to everyone (including hackers) when only a handful of authorized administrators would even have SSH accounts, much less do anything on the box. You keep it behind the VPN and only allow specific users access. It reduces the attack surface, creates audit trails, simplifies revoking network access, etc. This is security 101.
- nwh 13y ago> A honeypot is designed to attract attackers, and is designed with bad security in mind. I wouldn't say that. You'd be very hard pressed to find a production server without SSH, if not on the default port. I'm doing absolutely nothing to draw attention to myself, so it stands to reason that somebody who is (say, running a large website) would draw a lot more probes and "hacked" logins. > amongst them not running SSH in the open Moving SSH to a different port is the usual "fix" I see, which does next to nothing really. There's very little in terms of attacks against sshd, and none when you disable password based authentication. Having an open port is not an issue unto itself, unless you used an older Debian to generate your keys.
- acheron 13y agoMoving SSH to a different port does nothing if your system is being specifically targeted, but it stops 99% of drive-by bots. Not that they do much anyway but it at least stops them from showing up in your logs.
- nwh 13y agoJust out of interest I tried running on 22 and a very high random port, as you said significantly less, though not no attempts. I think it's a false sense of security more than anything.