3 ms·

Software on my deciated server already blocked attacks from IP's belonging to: - China - Mongolia - Netherlands - Turkey - Iran - Moldova - Romania - Ka

by gesman 13y ago

Software on my deciated server already blocked attacks from IP's belonging to: - China - Mongolia - Netherlands - Turkey - Iran - Moldova - Romania - Kazakhstan - France - Taiwan - UK Pretty diversified attack in progress.

JonnieCache 13y ago
That's normal though right? Are you comparing this to historical data? Also, what kind of attacks are you seeing?
level09 13y ago
What software are you using ? was it a large scale attack ?
- gesman 13y ago
  I use http://www.configserver.com/ http://www.configserver.com/. I love it as it blocks any crap that tries to hack in automatically at iptables level. Judging by logs I see about 2x-3x more break-in attempts to misc system services.
chewxy 13y ago
Are you using something like fail2ban? I'm seeing slightly higher activities on all my servers, but I doubt it's actually statistically significant (i.e. not different from random)
- macNchz 13y ago
  A glance at the logs and it looks like our dedicated servers are fail2banning IPs at pretty much the normal background level—i.e. a fairly steady stream of mostly Chinese addresses all day long.
  - kbar13 13y ago
    I would like to take this opportunity to air my grievances regarding fail2ban. I'm not a security researcher, but fail2ban appears to be a log prettifier instead of an actual security apparatus, as it doesn't actually prevent anyone from logging into your box. Unless you've configured fail2ban to ban IPs after 1 failed attempt, if you don't have a secure password or any other such basic security measures, you are still at risk of getting pwned. Instead of taking the time with fail2ban, I personally just make sure everyone uses passphrased ssh keys, or use a strong password in conjunction with a yubikey or 2 factor authentication and call it a day.
jdubs 13y ago
Blocking ips from countries is not an exact science as network blocks are traded frequently and networks do not conform to lines on maps.
- dredmorbius 13y ago
  My read was that the software was blocking specific CIDR blocks, and those blocks were within the allocations of the listed countries. Not that he was doing country-wide blocks. Though I could see doing that in some cases (e.g., you do no legitimate business with country Z, but get some high percentage of attack traffic from it). Metcalfe's law fails to account for the fact that many nodes in fact contribute negative value to the network. I prefer CIDR-level blocks myself, if single-IP blocks prove too whack-a-mole-ish.

by gesman 13y ago

JonnieCache 13y ago

That's normal though right? Are you comparing this to historical data? Also, what kind of attacks are you seeing?

level09 13y ago

What software are you using ? was it a large scale attack ?

gesman 13y ago
I use http://www.configserver.com/ http://www.configserver.com/. I love it as it blocks any crap that tries to hack in automatically at iptables level. Judging by logs I see about 2x-3x more break-in attempts to misc system services.

chewxy 13y ago

Are you using something like fail2ban? I'm seeing slightly higher activities on all my servers, but I doubt it's actually statistically significant (i.e. not different from random)

macNchz 13y ago
A glance at the logs and it looks like our dedicated servers are fail2banning IPs at pretty much the normal background level—i.e. a fairly steady stream of mostly Chinese addresses all day long.
- kbar13 13y ago
  I would like to take this opportunity to air my grievances regarding fail2ban. I'm not a security researcher, but fail2ban appears to be a log prettifier instead of an actual security apparatus, as it doesn't actually prevent anyone from logging into your box. Unless you've configured fail2ban to ban IPs after 1 failed attempt, if you don't have a secure password or any other such basic security measures, you are still at risk of getting pwned. Instead of taking the time with fail2ban, I personally just make sure everyone uses passphrased ssh keys, or use a strong password in conjunction with a yubikey or 2 factor authentication and call it a day.

jdubs 13y ago

Blocking ips from countries is not an exact science as network blocks are traded frequently and networks do not conform to lines on maps.

dredmorbius 13y ago
My read was that the software was blocking specific CIDR blocks, and those blocks were within the allocations of the listed countries. Not that he was doing country-wide blocks. Though I could see doing that in some cases (e.g., you do no legitimate business with country Z, but get some high percentage of attack traffic from it). Metcalfe's law fails to account for the fact that many nodes in fact contribute negative value to the network. I prefer CIDR-level blocks myself, if single-IP blocks prove too whack-a-mole-ish.