Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #190158 > unrolled thread

port scans (OT?)

Back to article view | Back to linux.debian.user

Contents

  port scans (OT?) Glenn English <ghe2001@gmail.com> - 2017-12-22 21:40 +0100
    Re: port scans (OT?) Dan Ritter <dsr@randomstring.org> - 2017-12-22 22:00 +0100
    Re: port scans (OT?) Cindy-Sue Causey <butterflybytes@gmail.com> - 2017-12-22 22:00 +0100
    Re: port scans (OT?) "Thomas Schmitt" <scdbackup@gmx.net> - 2017-12-22 22:10 +0100
      Re: port scans (OT?) Richard Hector <richard@walnut.gen.nz> - 2017-12-23 00:20 +0100
        Re: port scans (OT?) "Thomas Schmitt" <scdbackup@gmx.net> - 2017-12-23 08:40 +0100
      Re: port scans (OT?) Glenn English <ghe2001@gmail.com> - 2017-12-23 01:40 +0100
    Re: port scans (OT?) Brian <ad44@cityscape.co.uk> - 2017-12-23 00:00 +0100

#190158 — port scans (OT?)

Debian Squeeze (?) very old anyway, Dell server, Juniper SSG5
firewall. 1,000 miles away.

I've started getting email from the firewall down there saying that it
detected a port scan. Often enough of them to concern me -- several
times a day.

-- One just came in. Another 4 hours ago. From different IPs, from
different (RIPE) countries. --

Is there any way to stop them? AFAIK, there isn't. I sure can't think of a way.

The 'JuniperUsers list' says to talk to my upstream ISP. But I don't
see how that would help if they can't do anything either (they also
use Juniper).

The firewall blocks them after it sees 10 hits from the same IP in
5000 microseconds. But by then Nmap (or eq) has hit 10 ports.

Am I overly paranoid here? What if a non-script-kiddie is also doing
this, but slowly enough that the firewall doesn't detect it?

--
Glenn English

[toc] | [next] | [standalone]

#190159

On Fri, Dec 22, 2017 at 08:33:23PM +0000, Glenn English wrote:
> Debian Squeeze (?) very old anyway, Dell server, Juniper SSG5
> firewall. 1,000 miles away.
> 
> I've started getting email from the firewall down there saying that it
> detected a port scan. Often enough of them to concern me -- several
> times a day.
> 
> -- One just came in. Another 4 hours ago. From different IPs, from
> different (RIPE) countries. --
> 
> Is there any way to stop them? AFAIK, there isn't. I sure can't think of a way.
> 
> The 'JuniperUsers list' says to talk to my upstream ISP. But I don't
> see how that would help if they can't do anything either (they also
> use Juniper).
> 
> The firewall blocks them after it sees 10 hits from the same IP in
> 5000 microseconds. But by then Nmap (or eq) has hit 10 ports.
> 
> Am I overly paranoid here? What if a non-script-kiddie is also doing
> this, but slowly enough that the firewall doesn't detect it?

This is part of the background noise of the Internet.

What you can do:

- make sure your firewall only allows in new connections that
  you actually want. 

- rate limit new connections.

- run fail2ban or similar detect-and-block scanners on the
  ports that you have open. In addition to the basic config,
  I recommend a perma-ban list for IPs that hit you repeatedly
  over long periods of time. And always keep your whitelist
  up to date

- keep up to date with security related packages

-dsr-

[toc] | [prev] | [next] | [standalone]

#190161

On 12/22/17, Glenn English <ghe2001@gmail.com> wrote:
> Debian Squeeze (?) very old anyway, Dell server, Juniper SSG5
> firewall. 1,000 miles away.
>
> I've started getting email from the firewall down there saying that it
> detected a port scan. Often enough of them to concern me -- several
> times a day.
>
> -- One just came in. Another 4 hours ago. From different IPs, from
> different (RIPE) countries. --
>
> Is there any way to stop them? AFAIK, there isn't. I sure can't think of a
> way.
>
> The 'JuniperUsers list' says to talk to my upstream ISP. But I don't
> see how that would help if they can't do anything either (they also
> use Juniper).
>
> The firewall blocks them after it sees 10 hits from the same IP in
> 5000 microseconds. But by then Nmap (or eq) has hit 10 ports.
>
> Am I overly paranoid here? What if a non-script-kiddie is also doing
> this, but slowly enough that the firewall doesn't detect it?


On a related note in the other direction... or possibly maybe both
directions... how do stealthily planted "data" (bitcoin?) miners show
up in traffic?

Or do they even show up?

My uneducated guess is that, once planted by a hacker, the traffic
would be outgoing, but this thread makes me wonder. I started noticing
traffic show up from a "slightly out of state", *RANK* location along
with something else that I'm going to ask around about behind the
scenes. That traffic may have always been there in my case, but
something else coincided that makes me wonder if this is something
new....

Especially coincidentally to Glenn noticing his..

Cindy :)
-- 
Cindy-Sue Causey
Talking Rock, Pickens County, Georgia, USA

* runs with duct tape *

[toc] | [prev] | [next] | [standalone]

#190162

Hi,

Glenn English wrote:
> port scan[s] ... Is there any way to stop them?

You can make their life harder by running slow servers at some ports.
It can be funny to watch with SSH attack attempts. Usually it lasts 10
or 15 seconds until the visitor gives up. Dumb ones repeat the attempt
with the next login name.

Also cool: If file sharers show up, then keep one on hold until a second
one calls. Then forward their requests to the respective other one.
Two revenges taken for the price of one.


> Am I overly paranoid here? What if a non-script-kiddie is also doing
> this, but slowly enough that the firewall doesn't detect it?

Run your own port scan and shut down any insecure service that gets found.
Have no password-only SSH accounts but rather demand public-key
authoriziation.


Have a nice day :)

Thomas

[toc] | [prev] | [next] | [standalone]

#190173

[Multipart message — attachments visible in raw view] — view raw

On 23/12/17 10:04, Thomas Schmitt wrote:
> Also cool: If file sharers show up, then keep one on hold until a second
> one calls. Then forward their requests to the respective other one.
> Two revenges taken for the price of one.

So you're acting as a proxy? Does that mean that all files transferred
will use your bandwidth, twice, and any enforcement authorities that
come looking will assume you're the one doing it?

Richard

[toc] | [prev] | [next] | [standalone]

#190182

Hi,

Richard Hector wrote:
> Does that mean that all files transferred
> will use your bandwidth, twice, and any enforcement authorities that
> come looking will assume you're the one doing it?

No. Two confused client programs will try to get each other to work.
At a rate of 10 bytes per second they need quite some time to notice
that they are misconnected. Of course my Foppserver imposes a transfer
limit and from time to time alters one of the few transferred bytes.

It lasts less long if i connect the caller with the same port number
on his own machine that he uses on my machine. Seems to be a normal
user error and expected by the clients.

But that's nostalgy meanwhile. Network hardware has changed and i don't
get to see the visitors at my workstation any more.


Have a nice day :)

Thomas

[toc] | [prev] | [next] | [standalone]

#190179

On Fri, Dec 22, 2017 at 9:04 PM, Thomas Schmitt <scdbackup@gmx.net> wrote:

> Hi,

Hi

> Run your own port scan and shut down any insecure service that gets found.

Tried that and the firewall caught me and threw me out :-)

So I tried again, slower to stay out of the firewall's window, and the
only peculiar thing that showed up was rpcbind -- I have no idea what
idiot put that there. But that one's blocked at the server by
iptables' default drop.

I'm assuming Postfix, Dovecot, Proftp, Apache2, and openSSH are
smarter than the script kiddies.

So I'm feeling a lot better. From what you all say, port scans are to
be expected, and I can calm down some and do the standard Internet
things that keep the blackHats out.

> Have no password-only SSH accounts but rather demand public-key
> authoriziation.

Already did that, and iptables and SSHd allow only me and my IP in anyway.

> Have a nice day :)

Much better, and thank all of you for your help and advice...

--
Glenn English

[toc] | [prev] | [next] | [standalone]

#190172

On Fri 22 Dec 2017 at 20:33:23 +0000, Glenn English wrote:

> Debian Squeeze (?) very old anyway, Dell server, Juniper SSG5
> firewall. 1,000 miles away.
> 
> I've started getting email from the firewall down there saying that it
> detected a port scan. Often enough of them to concern me -- several
> times a day.

Someone's knocking on your door; you know the entrance to be secure
enough. What bothers you? Sit back and let them knock.

-- 
Brian.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web