Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #4333 > unrolled thread

Increased SSH breakin attempts

Back to article view | Back to comp.os.linux.networking

Contents

  Increased SSH breakin attempts Harold Johanssen <noemail@please.net> - 2019-04-03 20:17 +0000
    Re: Increased SSH breakin attempts Lew Pitcher <lew.pitcher@digitalfreehold.ca> - 2019-04-03 16:38 -0400
      Re: Increased SSH breakin attempts Harold Johanssen <noemail@please.net> - 2019-04-03 21:13 +0000
        Re: Increased SSH breakin attempts Grant Taylor <gtaylor@tnetconsulting.net> - 2019-04-03 15:23 -0600
      Re: Increased SSH breakin attempts "Carlos E.R." <robin_listas@es.invalid> - 2019-04-03 23:14 +0200
    Re: Increased SSH breakin attempts Dick <rsutton43@comcast.net> - 2019-04-03 17:33 -0400
      Re: Increased SSH breakin attempts Harold Johanssen <noemail@please.net> - 2019-04-03 22:01 +0000
        Re: Increased SSH breakin attempts William Unruh <unruh@invalid.ca> - 2019-04-04 00:27 +0000
          Re: Increased SSH breakin attempts Harold Johanssen <noemail@please.net> - 2019-04-04 14:02 +0000
            Re: Increased SSH breakin attempts William Unruh <unruh@invalid.ca> - 2019-04-04 18:22 +0000
              Re: Increased SSH breakin attempts Harold Johanssen <noemail@please.net> - 2019-04-04 19:15 +0000
    Re: Increased SSH breakin attempts William Unruh <unruh@invalid.ca> - 2019-04-03 21:51 +0000
      Re: Increased SSH breakin attempts Jorgen Grahn <grahn+nntp@snipabacken.se> - 2019-04-05 18:08 +0000
        Re: Increased SSH breakin attempts William Unruh <unruh@invalid.ca> - 2019-04-05 18:45 +0000
          Re: Increased SSH breakin attempts Jorgen Grahn <grahn+nntp@snipabacken.se> - 2019-04-05 22:24 +0000
          Re: Increased SSH breakin attempts Richard Kettlewell <invalid@invalid.invalid> - 2019-04-06 11:40 +0100
            Re: Increased SSH breakin attempts "Carlos E.R." <robin_listas@es.invalid> - 2019-04-06 12:53 +0200
            Re: Increased SSH breakin attempts William Unruh <unruh@invalid.ca> - 2019-04-06 18:13 +0000
              Re: Increased SSH breakin attempts "Carlos E.R." <robin_listas@es.invalid> - 2019-04-06 20:28 +0200
                Re: Increased SSH breakin attempts William Unruh <unruh@invalid.ca> - 2019-04-06 18:54 +0000
                Re: Increased SSH breakin attempts Richard Kettlewell <invalid@invalid.invalid> - 2019-04-07 08:08 +0100
                  Re: Increased SSH breakin attempts William Unruh <unruh@invalid.ca> - 2019-04-07 15:43 +0000
                    Re: Increased SSH breakin attempts Richard Kettlewell <invalid@invalid.invalid> - 2019-04-07 16:52 +0100

Page 1 of 2  [1] 2  Next page →

#4333 — Increased SSH breakin attempts

	For a while now I have noticed a significant increase in brute-
force password breaking attempts at my SSH server exposed to the 
Internet. There has always been traffic like that there, but it has 
recently become far more voluminous than usual: my domain is a 
nondescript one, with nothing much interesting, and it is registering 
such attempts to the tune of several per minute, when it used to be more 
like one, maybe two, per minute. 

	The attempts are coming from lots of different IP addresses all 
over the place, but I wonder if it is a single bot controlling thousands 
of different PCs? Anyway, has anybody noticed a similarly recent traffic 
increase in their exposed SSH interfaces? 

[toc] | [next] | [standalone]

#4334

Harold Johanssen wrote:

> For a while now I have noticed a significant increase in brute-
> force password breaking attempts at my SSH server exposed to the
> Internet. There has always been traffic like that there, but it has
> recently become far more voluminous than usual: my domain is a
> nondescript one, with nothing much interesting, and it is registering
> such attempts to the tune of several per minute, when it used to be more
> like one, maybe two, per minute.
> 
> The attempts are coming from lots of different IP addresses all
> over the place, but I wonder if it is a single bot controlling thousands
> of different PCs? Anyway, has anybody noticed a similarly recent traffic
> increase in their exposed SSH interfaces?

I've experienced the same sort of attacks for a couple of years now. I 
suspect a botnet, as, while the username attempts seem mostly to come in 
dictionary order, the originating IP addresses differ considerably.

-- 
Lew Pitcher
"In Skills, We Trust"

[toc] | [prev] | [next] | [standalone]

#4335

On Wed, 03 Apr 2019 16:38:32 -0400, Lew Pitcher wrote:

> Harold Johanssen wrote:
> 
>> For a while now I have noticed a significant increase in brute-
>> force password breaking attempts at my SSH server exposed to the
>> Internet. There has always been traffic like that there, but it has
>> recently become far more voluminous than usual: my domain is a
>> nondescript one, with nothing much interesting, and it is registering
>> such attempts to the tune of several per minute, when it used to be
>> more like one, maybe two, per minute.
>> 
>> The attempts are coming from lots of different IP addresses all over
>> the place, but I wonder if it is a single bot controlling thousands of
>> different PCs? Anyway, has anybody noticed a similarly recent traffic
>> increase in their exposed SSH interfaces?
> 
> I've experienced the same sort of attacks for a couple of years now. I
> suspect a botnet, as, while the username attempts seem mostly to come in
> dictionary order, the originating IP addresses differ considerably.

	Thanks. In my case, the vast majority are for root, with lots of 
ordinary name (test, ftpuser, pi, etc.) appearing every so often. 
Fortunately, I am in a position to establish white lists and filter out 
this junk at will.

[toc] | [prev] | [next] | [standalone]

#4338

On 4/3/19 3:13 PM, Harold Johanssen wrote:
> I am in a position to establish white lists and filter out this junk 
> at will.

I'd suggest pontificating the following:

  - Using an alternate port
  - Rate limiting
     - tc
     - iptables
        - recent
        - ipset
        - other time based matches that I'm forgetting
  - Port knocking / Single Packet Authorization
  - IPSec / other VPN



-- 
Grant. . . .
unix || die

[toc] | [prev] | [next] | [standalone]

#4336

On 03/04/2019 22.38, Lew Pitcher wrote:
> Harold Johanssen wrote:
> 
>> For a while now I have noticed a significant increase in brute-
>> force password breaking attempts at my SSH server exposed to the
>> Internet. There has always been traffic like that there, but it has
>> recently become far more voluminous than usual: my domain is a
>> nondescript one, with nothing much interesting, and it is registering
>> such attempts to the tune of several per minute, when it used to be more
>> like one, maybe two, per minute.
>>
>> The attempts are coming from lots of different IP addresses all
>> over the place, but I wonder if it is a single bot controlling thousands
>> of different PCs? Anyway, has anybody noticed a similarly recent traffic
>> increase in their exposed SSH interfaces?
> 
> I've experienced the same sort of attacks for a couple of years now. I 
> suspect a botnet, as, while the username attempts seem mostly to come in 
> dictionary order, the originating IP addresses differ considerably.

My router doesn't report on that. I closed its 22 port on its firewall,
but it never reported anything.

The actual ssh is on a high port, redirected to a machine inside, and
nothing touches it.

Thus, unless you really need to use port 22, don't. Put it above 40000.

-- 
Cheers, Carlos.

[toc] | [prev] | [next] | [standalone]

#4339

On 4/3/2019 4:17 PM, Harold Johanssen wrote:
> 	For a while now I have noticed a significant increase in brute-
> force password breaking attempts at my SSH server exposed to the
> Internet. There has always been traffic like that there, but it has
> recently become far more voluminous than usual: my domain is a
> nondescript one, with nothing much interesting, and it is registering
> such attempts to the tune of several per minute, when it used to be more
> like one, maybe two, per minute.
> 
> 	The attempts are coming from lots of different IP addresses all
> over the place, but I wonder if it is a single bot controlling thousands
> of different PCs? Anyway, has anybody noticed a similarly recent traffic
> increase in their exposed SSH interfaces?
> 
> 
Even though you didn't ask for possible solutions, I use FailToBan. 
Like you, I had all kinds of log noise on port 22, so I too, picked a 
random high number port. That cleared up most of the log noise, but by 
using failtoban, it manipulates iptables such that you can simply set 
retry counts, over a given time span, and automatically block would be 
intruders for a number of minutes.  It actually solved my problem 
because I only use the external ssh port when I'm traveling (using 
certificates).

It's just a suggestion to look into and it solved my use case.
Dick

[toc] | [prev] | [next] | [standalone]

#4341

On Wed, 03 Apr 2019 17:33:46 -0400, Dick wrote:

> On 4/3/2019 4:17 PM, Harold Johanssen wrote:
>> 	For a while now I have noticed a significant increase in brute-
>> force password breaking attempts at my SSH server exposed to the
>> Internet. There has always been traffic like that there, but it has
>> recently become far more voluminous than usual: my domain is a
>> nondescript one, with nothing much interesting, and it is registering
>> such attempts to the tune of several per minute, when it used to be
>> more like one, maybe two, per minute.
>> 
>> 	The attempts are coming from lots of different IP addresses all
>> over the place, but I wonder if it is a single bot controlling
>> thousands of different PCs? Anyway, has anybody noticed a similarly
>> recent traffic increase in their exposed SSH interfaces?
>> 
>> 
> Even though you didn't ask for possible solutions, I use FailToBan. Like
> you, I had all kinds of log noise on port 22, so I too, picked a random
> high number port. That cleared up most of the log noise, but by using
> failtoban, it manipulates iptables such that you can simply set retry
> counts, over a given time span, and automatically block would be
> intruders for a number of minutes.  It actually solved my problem
> because I only use the external ssh port when I'm traveling (using
> certificates).
> 
> It's just a suggestion to look into and it solved my use case.
> Dick

	Thanks. In my case, it as simple as the following:

	# iptables -A INPUT -p tcp --dport 22 --source 192.168.0.0/24 -j 
ACCEPT

for host in my internal network.

	# iptables -A INPUT -p tcp --dport 22 --source <ip-address> -j 
ACCEPT

where <ip-address> represents a small collection of IP addresses that I 
know to be genuine.

	# iptables -D INPUT -p tcp --dport 22 -j DROP

This eliminates all the noise. 

[toc] | [prev] | [next] | [standalone]

#4342

On 2019-04-03, Harold Johanssen <noemail@please.net> wrote:
> On Wed, 03 Apr 2019 17:33:46 -0400, Dick wrote:
>
>> On 4/3/2019 4:17 PM, Harold Johanssen wrote:
>>> 	For a while now I have noticed a significant increase in brute-
>>> force password breaking attempts at my SSH server exposed to the
>>> Internet. There has always been traffic like that there, but it has
>>> recently become far more voluminous than usual: my domain is a
>>> nondescript one, with nothing much interesting, and it is registering
>>> such attempts to the tune of several per minute, when it used to be
>>> more like one, maybe two, per minute.
>>> 
>>> 	The attempts are coming from lots of different IP addresses all
>>> over the place, but I wonder if it is a single bot controlling
>>> thousands of different PCs? Anyway, has anybody noticed a similarly
>>> recent traffic increase in their exposed SSH interfaces?
>>> 
>>> 
>> Even though you didn't ask for possible solutions, I use FailToBan. Like
>> you, I had all kinds of log noise on port 22, so I too, picked a random
>> high number port. That cleared up most of the log noise, but by using
>> failtoban, it manipulates iptables such that you can simply set retry
>> counts, over a given time span, and automatically block would be
>> intruders for a number of minutes.  It actually solved my problem
>> because I only use the external ssh port when I'm traveling (using
>> certificates).
>> 
>> It's just a suggestion to look into and it solved my use case.
>> Dick
>
> 	Thanks. In my case, it as simple as the following:
>
> 	# iptables -A INPUT -p tcp --dport 22 --source 192.168.0.0/24 -j 
> ACCEPT
>
> for host in my internal network.
>
> 	# iptables -A INPUT -p tcp --dport 22 --source <ip-address> -j 
> ACCEPT
>
> where <ip-address> represents a small collection of IP addresses that I 
> know to be genuine.
>
> 	# iptables -D INPUT -p tcp --dport 22 -j DROP
>
> This eliminates all the noise. 

Sure. Except it does not work for those of us who seem to spend half
their time elsewhere on the globe than at home.

[toc] | [prev] | [next] | [standalone]

#4344

On Thu, 04 Apr 2019 00:27:06 +0000, William Unruh wrote:

> On 2019-04-03, Harold Johanssen <noemail@please.net> wrote:
>> On Wed, 03 Apr 2019 17:33:46 -0400, Dick wrote:
>>
>>> On 4/3/2019 4:17 PM, Harold Johanssen wrote:
>>>> 	For a while now I have noticed a significant increase in brute-
>>>> force password breaking attempts at my SSH server exposed to the
>>>> Internet. There has always been traffic like that there, but it has
>>>> recently become far more voluminous than usual: my domain is a
>>>> nondescript one, with nothing much interesting, and it is registering
>>>> such attempts to the tune of several per minute, when it used to be
>>>> more like one, maybe two, per minute.
>>>> 
>>>> 	The attempts are coming from lots of different IP addresses all
>>>> over the place, but I wonder if it is a single bot controlling
>>>> thousands of different PCs? Anyway, has anybody noticed a similarly
>>>> recent traffic increase in their exposed SSH interfaces?
>>>> 
>>>> 
>>> Even though you didn't ask for possible solutions, I use FailToBan.
>>> Like you, I had all kinds of log noise on port 22, so I too, picked a
>>> random high number port. That cleared up most of the log noise, but by
>>> using failtoban, it manipulates iptables such that you can simply set
>>> retry counts, over a given time span, and automatically block would be
>>> intruders for a number of minutes.  It actually solved my problem
>>> because I only use the external ssh port when I'm traveling (using
>>> certificates).
>>> 
>>> It's just a suggestion to look into and it solved my use case.
>>> Dick
>>
>> 	Thanks. In my case, it as simple as the following:
>>
>> 	# iptables -A INPUT -p tcp --dport 22 --source 192.168.0.0/24 -j
>> ACCEPT
>>
>> for host in my internal network.
>>
>> 	# iptables -A INPUT -p tcp --dport 22 --source <ip-address> -j
>> ACCEPT
>>
>> where <ip-address> represents a small collection of IP addresses that I
>> know to be genuine.
>>
>> 	# iptables -D INPUT -p tcp --dport 22 -j DROP
>>
>> This eliminates all the noise.
> 
> Sure. Except it does not work for those of us who seem to spend half
> their time elsewhere on the globe than at home.

	Well, for that situation I use an intermediate system, managed by 
a separate organization, that is accessible from everywhere. I establish 
an ssh tunnel through it to my own ssh server, and everything works 
seamlessly.

[toc] | [prev] | [next] | [standalone]

#4346

On 2019-04-04, Harold Johanssen <noemail@please.net> wrote:
> On Thu, 04 Apr 2019 00:27:06 +0000, William Unruh wrote:
>
>> On 2019-04-03, Harold Johanssen <noemail@please.net> wrote:
>>> On Wed, 03 Apr 2019 17:33:46 -0400, Dick wrote:
>>>
>>>> On 4/3/2019 4:17 PM, Harold Johanssen wrote:
>>>>> 	For a while now I have noticed a significant increase in brute-
>>>>> force password breaking attempts at my SSH server exposed to the
>>>>> Internet. There has always been traffic like that there, but it has
>>>>> recently become far more voluminous than usual: my domain is a
>>>>> nondescript one, with nothing much interesting, and it is registering
>>>>> such attempts to the tune of several per minute, when it used to be
>>>>> more like one, maybe two, per minute.
>>>>> 
>>>>> 	The attempts are coming from lots of different IP addresses all
>>>>> over the place, but I wonder if it is a single bot controlling
>>>>> thousands of different PCs? Anyway, has anybody noticed a similarly
>>>>> recent traffic increase in their exposed SSH interfaces?
>>>>> 
>>>>> 
>>>> Even though you didn't ask for possible solutions, I use FailToBan.
>>>> Like you, I had all kinds of log noise on port 22, so I too, picked a
>>>> random high number port. That cleared up most of the log noise, but by
>>>> using failtoban, it manipulates iptables such that you can simply set
>>>> retry counts, over a given time span, and automatically block would be
>>>> intruders for a number of minutes.  It actually solved my problem
>>>> because I only use the external ssh port when I'm traveling (using
>>>> certificates).
>>>> 
>>>> It's just a suggestion to look into and it solved my use case.
>>>> Dick
>>>
>>> 	Thanks. In my case, it as simple as the following:
>>>
>>> 	# iptables -A INPUT -p tcp --dport 22 --source 192.168.0.0/24 -j
>>> ACCEPT
>>>
>>> for host in my internal network.
>>>
>>> 	# iptables -A INPUT -p tcp --dport 22 --source <ip-address> -j
>>> ACCEPT
>>>
>>> where <ip-address> represents a small collection of IP addresses that I
>>> know to be genuine.
>>>
>>> 	# iptables -D INPUT -p tcp --dport 22 -j DROP
>>>
>>> This eliminates all the noise.
>> 
>> Sure. Except it does not work for those of us who seem to spend half
>> their time elsewhere on the globe than at home.
>
> 	Well, for that situation I use an intermediate system, managed by 
> a separate organization, that is accessible from everywhere. I establish 
> an ssh tunnel through it to my own ssh server, and everything works 
> seamlessly.

So then you have to rely on the competence of the people who manage that
intermediate system. They get broken into, and then so you do. It does
not seem much of an security advance.

[toc] | [prev] | [next] | [standalone]

#4347

On Thu, 04 Apr 2019 18:22:03 +0000, William Unruh wrote:

> On 2019-04-04, Harold Johanssen <noemail@please.net> wrote:
>> On Thu, 04 Apr 2019 00:27:06 +0000, William Unruh wrote:
>>
>>> On 2019-04-03, Harold Johanssen <noemail@please.net> wrote:
>>>> On Wed, 03 Apr 2019 17:33:46 -0400, Dick wrote:
>>>>
>>>>> On 4/3/2019 4:17 PM, Harold Johanssen wrote:
>>>>>> 	For a while now I have noticed a significant increase in brute-
>>>>>> force password breaking attempts at my SSH server exposed to the
>>>>>> Internet. There has always been traffic like that there, but it has
>>>>>> recently become far more voluminous than usual: my domain is a
>>>>>> nondescript one, with nothing much interesting, and it is
>>>>>> registering such attempts to the tune of several per minute, when
>>>>>> it used to be more like one, maybe two, per minute.
>>>>>> 
>>>>>> 	The attempts are coming from lots of different IP addresses all
>>>>>> over the place, but I wonder if it is a single bot controlling
>>>>>> thousands of different PCs? Anyway, has anybody noticed a similarly
>>>>>> recent traffic increase in their exposed SSH interfaces?
>>>>>> 
>>>>>> 
>>>>> Even though you didn't ask for possible solutions, I use FailToBan.
>>>>> Like you, I had all kinds of log noise on port 22, so I too, picked
>>>>> a random high number port. That cleared up most of the log noise,
>>>>> but by using failtoban, it manipulates iptables such that you can
>>>>> simply set retry counts, over a given time span, and automatically
>>>>> block would be intruders for a number of minutes.  It actually
>>>>> solved my problem because I only use the external ssh port when I'm
>>>>> traveling (using certificates).
>>>>> 
>>>>> It's just a suggestion to look into and it solved my use case.
>>>>> Dick
>>>>
>>>> 	Thanks. In my case, it as simple as the following:
>>>>
>>>> 	# iptables -A INPUT -p tcp --dport 22 --source 192.168.0.0/24 -j
>>>> ACCEPT
>>>>
>>>> for host in my internal network.
>>>>
>>>> 	# iptables -A INPUT -p tcp --dport 22 --source <ip-address> -j
>>>> ACCEPT
>>>>
>>>> where <ip-address> represents a small collection of IP addresses that
>>>> I know to be genuine.
>>>>
>>>> 	# iptables -D INPUT -p tcp --dport 22 -j DROP
>>>>
>>>> This eliminates all the noise.
>>> 
>>> Sure. Except it does not work for those of us who seem to spend half
>>> their time elsewhere on the globe than at home.
>>
>> 	Well, for that situation I use an intermediate system, managed by
>> a separate organization, that is accessible from everywhere. I
>> establish an ssh tunnel through it to my own ssh server, and everything
>> works seamlessly.
> 
> So then you have to rely on the competence of the people who manage that
> intermediate system. They get broken into, and then so you do. It does
> not seem much of an security advance.

	In my case, I have no reason to doubt the competence of those who 
manage that intermediate system, and I have lots of evidence to think 
that they know their way around these issues better than myself. My goal 
was to prevent junk data from appearing in my logs. I am satisfied that 
the security aspects are already well taken care of.

[toc] | [prev] | [next] | [standalone]

#4340

On 2019-04-03, Harold Johanssen <noemail@please.net> wrote:
> 	For a while now I have noticed a significant increase in brute-
> force password breaking attempts at my SSH server exposed to the 
> Internet. There has always been traffic like that there, but it has 
> recently become far more voluminous than usual: my domain is a 
> nondescript one, with nothing much interesting, and it is registering 
> such attempts to the tune of several per minute, when it used to be more 
> like one, maybe two, per minute. 
>
> 	The attempts are coming from lots of different IP addresses all 
> over the place, but I wonder if it is a single bot controlling thousands 
> of different PCs? Anyway, has anybody noticed a similarly recent traffic 
> increase in their exposed SSH interfaces? 
>
>

Yes, I have noticed a substatial increase for about the past 2 months (
a difference of a factor of 10 or so). The passwords, which I capture
for failed attempts, are mostly "obvious" ones
123456
123qweasd
p a s s w o r d
Only about 1/2 of the unique ones are in the pwned password database.

Mine are more like 400/day.

[toc] | [prev] | [next] | [standalone]

#4351

On Wed, 2019-04-03, William Unruh wrote:
> On 2019-04-03, Harold Johanssen <noemail@please.net> wrote:
>> 	For a while now I have noticed a significant increase in brute-
>> force password breaking attempts at my SSH server exposed to the 
>> Internet. There has always been traffic like that there, but it has 
>> recently become far more voluminous than usual: my domain is a 
>> nondescript one, with nothing much interesting, and it is registering 
>> such attempts to the tune of several per minute, when it used to be more 
>> like one, maybe two, per minute. 
>>
>> 	The attempts are coming from lots of different IP addresses all 
>> over the place, but I wonder if it is a single bot controlling thousands 
>> of different PCs? Anyway, has anybody noticed a similarly recent traffic 
>> increase in their exposed SSH interfaces? 
>
> Yes, I have noticed a substatial increase for about the past 2 months (
> a difference of a factor of 10 or so). The passwords, which I capture
> for failed attempts, are mostly "obvious" ones
> 123456
> 123qweasd
> p a s s w o r d
> Only about 1/2 of the unique ones are in the pwned password database.
>
> Mine are more like 400/day.

Up to 900/day here.  I can't say it bothers me much, though.

/Jorgen

-- 
  // Jorgen Grahn <grahn@  Oo  o.   .     .
\X/     snipabacken.se>   O  o   .

[toc] | [prev] | [next] | [standalone]

#4352

On 2019-04-05, Jorgen Grahn <grahn+nntp@snipabacken.se> wrote:
> On Wed, 2019-04-03, William Unruh wrote:
>> On 2019-04-03, Harold Johanssen <noemail@please.net> wrote:
>>> 	For a while now I have noticed a significant increase in brute-
>>> force password breaking attempts at my SSH server exposed to the 
>>> Internet. There has always been traffic like that there, but it has 
>>> recently become far more voluminous than usual: my domain is a 
>>> nondescript one, with nothing much interesting, and it is registering 
>>> such attempts to the tune of several per minute, when it used to be more 
>>> like one, maybe two, per minute. 
>>>
>>> 	The attempts are coming from lots of different IP addresses all 
>>> over the place, but I wonder if it is a single bot controlling thousands 
>>> of different PCs? Anyway, has anybody noticed a similarly recent traffic 
>>> increase in their exposed SSH interfaces? 
>>
>> Yes, I have noticed a substatial increase for about the past 2 months (
>> a difference of a factor of 10 or so). The passwords, which I capture
>> for failed attempts, are mostly "obvious" ones
>> 123456
>> 123qweasd
>> p a s s w o r d
>> Only about 1/2 of the unique ones are in the pwned password database.
>>
>> Mine are more like 400/day.
>
> Up to 900/day here.  I can't say it bothers me much, though.
>
> /Jorgen
>
No matter what the password, etc, there is always that small random
chance ( which includes some shoulder surfing, etc) that that password
to your system as user/root is guessed. And if it is one huge botnet
that is attacking you, they could also be guessing your passwords
without repetition. (independent attacks tend to come after you with the
same list of eassy passwords. With 10000 machines the attacker can go
far deeper into the password bag to try against you, since  the attacker
knows that machine 1265 has already tried the easy ones.

My guess is that the increase in number of attacks is linked to such
botnet behaviour. As I said only about half of the passwords are in the
pwned database, and over half are new passwords from day to day.

[toc] | [prev] | [next] | [standalone]

#4353

On Fri, 2019-04-05, William Unruh wrote:
> On 2019-04-05, Jorgen Grahn <grahn+nntp@snipabacken.se> wrote:
>> On Wed, 2019-04-03, William Unruh wrote:
>>> On 2019-04-03, Harold Johanssen <noemail@please.net> wrote:
>>>> 	For a while now I have noticed a significant increase in brute-
>>>> force password breaking attempts at my SSH server exposed to the 
>>>> Internet. There has always been traffic like that there, but it has 
>>>> recently become far more voluminous than usual: my domain is a 
>>>> nondescript one, with nothing much interesting, and it is registering 
>>>> such attempts to the tune of several per minute, when it used to be more 
>>>> like one, maybe two, per minute. 
>>>>
>>>> 	The attempts are coming from lots of different IP addresses all 
>>>> over the place, but I wonder if it is a single bot controlling thousands 
>>>> of different PCs? Anyway, has anybody noticed a similarly recent traffic 
>>>> increase in their exposed SSH interfaces? 
>>>
>>> Yes, I have noticed a substatial increase for about the past 2 months (
>>> a difference of a factor of 10 or so). The passwords, which I capture
>>> for failed attempts, are mostly "obvious" ones
>>> 123456
>>> 123qweasd
>>> p a s s w o r d
>>> Only about 1/2 of the unique ones are in the pwned password database.
>>>
>>> Mine are more like 400/day.
>>
>> Up to 900/day here.  I can't say it bothers me much, though.
>>
>> /Jorgen
>>
> No matter what the password, etc, there is always that small random
> chance ( which includes some shoulder surfing, etc) that that password
> to your system as user/root is guessed.

I have 'PasswordAuthentication no' configured, i.e. I require
public-key authentication.  But you're right: if I didn't and couldn't,
I would worry about these attacks.

I've even seen them succeed once, on someone else's laptop (which also
let root log in via ssh, and had a dumb root password).  That was
nasty.

/Jorgen

-- 
  // Jorgen Grahn <grahn@  Oo  o.   .     .
\X/     snipabacken.se>   O  o   .

[toc] | [prev] | [next] | [standalone]

#4354

William Unruh <unruh@invalid.ca> writes:
> No matter what the password, etc, there is always that small random
> chance ( which includes some shoulder surfing, etc) that that password
> to your system as user/root is guessed. And if it is one huge botnet
> that is attacking you, they could also be guessing your passwords
> without repetition. (independent attacks tend to come after you with
> the same list of eassy passwords. With 10000 machines the attacker can
> go far deeper into the password bag to try against you, since the
> attacker knows that machine 1265 has already tried the easy ones.

Attacker resource doesn’t scale in this scenario. The limiting factor is
the rate at which the target computes password hashes.

I currently have two systems with globally exposed SSH servers. The
faster can only compute a couple of hundred password hashes per second
(using the hash that is actually in use for my password). The slower
only about 10/second. Even on the faster it would take millions of years
for an attacker to discover my password through exhaustive search.

In any case password-based authentication is disabled for those systems.

https://github.com/ewxrjk/cryptbench is my measurement tool.

-- 
https://www.greenend.org.uk/rjk/

[toc] | [prev] | [next] | [standalone]

#4355

On 06/04/2019 12.40, Richard Kettlewell wrote:
> William Unruh <unruh@invalid.ca> writes:
>> No matter what the password, etc, there is always that small random
>> chance ( which includes some shoulder surfing, etc) that that password
>> to your system as user/root is guessed. And if it is one huge botnet
>> that is attacking you, they could also be guessing your passwords
>> without repetition. (independent attacks tend to come after you with
>> the same list of eassy passwords. With 10000 machines the attacker can
>> go far deeper into the password bag to try against you, since the
>> attacker knows that machine 1265 has already tried the easy ones.
> 
> Attacker resource doesn’t scale in this scenario. The limiting factor is
> the rate at which the target computes password hashes.
> 
> I currently have two systems with globally exposed SSH servers. The
> faster can only compute a couple of hundred password hashes per second
> (using the hash that is actually in use for my password). The slower
> only about 10/second. Even on the faster it would take millions of years
> for an attacker to discover my password through exhaustive search.
> 
> In any case password-based authentication is disabled for those systems.
> 
> https://github.com/ewxrjk/cryptbench is my measurement tool.
Simply moving to a high port makes the attacks zero in most cases. For
most private places the trick is easy to apply. For a public server, the
attacker would have to be determined to scan the place first to find ports.

-- 
Cheers, Carlos.

[toc] | [prev] | [next] | [standalone]

#4356

On 2019-04-06, Richard Kettlewell <invalid@invalid.invalid> wrote:
> William Unruh <unruh@invalid.ca> writes:
>> No matter what the password, etc, there is always that small random
>> chance ( which includes some shoulder surfing, etc) that that password
>> to your system as user/root is guessed. And if it is one huge botnet
>> that is attacking you, they could also be guessing your passwords
>> without repetition. (independent attacks tend to come after you with
>> the same list of eassy passwords. With 10000 machines the attacker can
>> go far deeper into the password bag to try against you, since the
>> attacker knows that machine 1265 has already tried the easy ones.
>
> Attacker resource doesn’t scale in this scenario. The limiting factor is
> the rate at which the target computes password hashes.
>
> I currently have two systems with globally exposed SSH servers. The
> faster can only compute a couple of hundred password hashes per second
> (using the hash that is actually in use for my password). The slower
> only about 10/second. Even on the faster it would take millions of years
> for an attacker to discover my password through exhaustive search.

That is certainly true. However almost noone uses "random passwords".
And the more passwords that the remote user can try, the higher the
probability that they will hit on the correct password. 
There is a nother problem. I got attacked by my university's IT because
they thought I had been hacked. One of the reasons was because of the
large number of ssh sessions which my machine had. They were the remote
attacks. As far as I know none of them got in.
(I explained all of the evidence that they adjused for my being broken
in, and they never got back to me.)


>
> In any case password-based authentication is disabled for those systems.

Is it really cler that passwordless login is better? 
If they get into a machine which you allow
remote access to your machine/account,  they have access to your
machine So are you sure that all of the machines that you allow to
access your system are safe as well, that none of the users on those
machines have weak passwords? 
The only breakin I have had was because one of my trusted users had a
network around the world of machines on which they used passwordless
login. Someone  broke into a machine across the world from me, tracked 
back through the network and got to my machine. 
The passwordless feature made the process easy. ( and yes, if machine B
has a passwordless attachment to broken A, then A probably has one to B.
Far far far easier than "brute force" on even an easy password.)

>
> https://github.com/ewxrjk/cryptbench is my measurement tool.
>

[toc] | [prev] | [next] | [standalone]

#4357

On 06/04/2019 20.13, William Unruh wrote:
> On 2019-04-06, Richard Kettlewell <invalid@invalid.invalid> wrote:


>> In any case password-based authentication is disabled for those systems.
> 
> Is it really cler that passwordless login is better? 
> If they get into a machine which you allow
> remote access to your machine/account,  they have access to your
> machine So are you sure that all of the machines that you allow to
> access your system are safe as well, that none of the users on those
> machines have weak passwords? 

There may be some confussion here.

It is possible to access an ssh site without using the password of the
site, by using a key pair (RSA? PKCS?). But access to these keys needs
another password, which may be disabled (I don't). Rather, the desktop
remembers the passphrase to access the keys for ssh access, so it seems
passwordless but it isn't.

An attacker that gets access to that client machine doesn't get access
to the server - however, the client machine may have both key files
stored. Are those two enough to get access?

> The only breakin I have had was because one of my trusted users had a
> network around the world of machines on which they used passwordless
> login. Someone  broke into a machine across the world from me, tracked 
> back through the network and got to my machine. 
> The passwordless feature made the process easy. ( and yes, if machine B
> has a passwordless attachment to broken A, then A probably has one to B.
> Far far far easier than "brute force" on even an easy password.)

Yes.

-- 
Cheers, Carlos.

[toc] | [prev] | [next] | [standalone]

#4358

On 2019-04-06, Carlos E.R. <robin_listas@es.invalid> wrote:
> On 06/04/2019 20.13, William Unruh wrote:
>> On 2019-04-06, Richard Kettlewell <invalid@invalid.invalid> wrote:
>
>
>>> In any case password-based authentication is disabled for those systems.
>> 
>> Is it really cler that passwordless login is better? 
>> If they get into a machine which you allow
>> remote access to your machine/account,  they have access to your
>> machine So are you sure that all of the machines that you allow to
>> access your system are safe as well, that none of the users on those
>> machines have weak passwords? 
>
> There may be some confussion here.
>
> It is possible to access an ssh site without using the password of the
> site, by using a key pair (RSA? PKCS?). But access to these keys needs
> another password, which may be disabled (I don't). Rather, the desktop
> remembers the passphrase to access the keys for ssh access, so it seems
> passwordless but it isn't.

In order to get passwordless access, your public key is stored in the
"authorized_keys" file on the remote machine you are signing int0. Your
machine signs an access request, and the remote machine decrypts it with
your public key to see if it really is you. 
Yes, the hacker would need to get access your key files, in particular
to your private key on your machine so they could sign the request. Many
people do not encrypt their key files, for convenience. 
If someone breaks in as them, they can then access those machines which
have your public key on them to allow passwordless access to the remote
machine. Are you sure that ALL of the users on all of the machines that
have passwordless access to your machine have protected their keys with
passwords? And even they people will open their ssh keys once with
ssh-agent. So if you can hijack their session, you also have access to
the private keys to sign requests to the remote host.

>
> An attacker that gets access to that client machine doesn't get access
> to the server - however, the client machine may have both key files
> stored. Are those two enough to get access?
>
>> The only breakin I have had was because one of my trusted users had a
>> network around the world of machines on which they used passwordless
>> login. Someone  broke into a machine across the world from me, tracked 
>> back through the network and got to my machine. 
>> The passwordless feature made the process easy. ( and yes, if machine B
>> has a passwordless attachment to broken A, then A probably has one to B.
>> Far far far easier than "brute force" on even an easy password.)
>
> Yes.
>

[toc] | [prev] | [next] | [standalone]

Page 1 of 2  [1] 2  Next page →

Back to top | Article view | comp.os.linux.networking

csiph-web