3 ms·

Why do people think it's worthwhile to file abuse complaints about port 22 connections? If I wanted to file a complaint about every random connection to port 22

Why do people think it's worthwhile to file abuse complaints about port 22 connections? If I wanted to file a complaint about every random connection to port 22 on one of my machines, it would be a full time job...

WizzleKake 13y ago
A lot of 'rouge' ssh traffic comes from hacked machines. If you contact the abuse department of a provider, they may get in touch with the owner of the machine to let them know that their box has been compromised.
- zippergz 13y ago
  Yes I know that, but I'm not convinced that the cost/benefit really makes sense for complaining. Back in my more idealistic days I did report a lot of abuse. But it's so rare for the recipient to actually do anything about it, and the volume of scans so high, it's just not worth my time.
- derleth 13y ago
  > A lot of 'rouge' ssh traffic comes from hacked machines. And they're owned by the Hell's Angles or Red China, I bet.
  - riffraff 13y ago
    Rouge Angles of Satin
marshray 13y ago
Well, if you had a "class A" address space, you would have seen 16777216 connection attempts in your firewall logs. Yeah, I imagine that would be a full time job.
SpenserJ 13y ago
Don't manually file them in that case. Install Fail2ban and automatically ban anyone with x failed attempts, and have it email fail2ban@blocklist.de. Their system will look up the correct abuse department, and forward it along on your behalf, along with thousands of others that report it. A large portion of them probably go ignored, but if you can get a fraction of them taken offline, then why not spend the five minutes to set it up? The bottom half of http://spenserj.com/blog/2013/07/15/securing-a-linux-server/ http://spenserj.com/blog/2013/07/15/securing-a-linux-server/ shows how few things you need to do to set up Fail2ban and Blocklist.de
- robertgraham 13y ago
  My scanner doesn't try to brute-force the logins. It's just grabbing the banner.

WizzleKake 13y ago

A lot of 'rouge' ssh traffic comes from hacked machines. If you contact the abuse department of a provider, they may get in touch with the owner of the machine to let them know that their box has been compromised.

zippergz 13y ago
Yes I know that, but I'm not convinced that the cost/benefit really makes sense for complaining. Back in my more idealistic days I did report a lot of abuse. But it's so rare for the recipient to actually do anything about it, and the volume of scans so high, it's just not worth my time.
derleth 13y ago
> A lot of 'rouge' ssh traffic comes from hacked machines. And they're owned by the Hell's Angles or Red China, I bet.
- riffraff 13y ago
  Rouge Angles of Satin

marshray 13y ago

Well, if you had a "class A" address space, you would have seen 16777216 connection attempts in your firewall logs. Yeah, I imagine that would be a full time job.

SpenserJ 13y ago

Don't manually file them in that case. Install Fail2ban and automatically ban anyone with x failed attempts, and have it email fail2ban@blocklist.de. Their system will look up the correct abuse department, and forward it along on your behalf, along with thousands of others that report it. A large portion of them probably go ignored, but if you can get a fraction of them taken offline, then why not spend the five minutes to set it up? The bottom half of http://spenserj.com/blog/2013/07/15/securing-a-linux-server/ http://spenserj.com/blog/2013/07/15/securing-a-linux-server/ shows how few things you need to do to set up Fail2ban and Blocklist.de

robertgraham 13y ago
My scanner doesn't try to brute-force the logins. It's just grabbing the banner.