Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #4346

Re: Increased SSH breakin attempts

Show all headers | View raw

On 2019-04-04, Harold Johanssen <noemail@please.net> wrote:
> On Thu, 04 Apr 2019 00:27:06 +0000, William Unruh wrote:
>
>> On 2019-04-03, Harold Johanssen <noemail@please.net> wrote:
>>> On Wed, 03 Apr 2019 17:33:46 -0400, Dick wrote:
>>>
>>>> On 4/3/2019 4:17 PM, Harold Johanssen wrote:
>>>>> 	For a while now I have noticed a significant increase in brute-
>>>>> force password breaking attempts at my SSH server exposed to the
>>>>> Internet. There has always been traffic like that there, but it has
>>>>> recently become far more voluminous than usual: my domain is a
>>>>> nondescript one, with nothing much interesting, and it is registering
>>>>> such attempts to the tune of several per minute, when it used to be
>>>>> more like one, maybe two, per minute.
>>>>> 
>>>>> 	The attempts are coming from lots of different IP addresses all
>>>>> over the place, but I wonder if it is a single bot controlling
>>>>> thousands of different PCs? Anyway, has anybody noticed a similarly
>>>>> recent traffic increase in their exposed SSH interfaces?
>>>>> 
>>>>> 
>>>> Even though you didn't ask for possible solutions, I use FailToBan.
>>>> Like you, I had all kinds of log noise on port 22, so I too, picked a
>>>> random high number port. That cleared up most of the log noise, but by
>>>> using failtoban, it manipulates iptables such that you can simply set
>>>> retry counts, over a given time span, and automatically block would be
>>>> intruders for a number of minutes.  It actually solved my problem
>>>> because I only use the external ssh port when I'm traveling (using
>>>> certificates).
>>>> 
>>>> It's just a suggestion to look into and it solved my use case.
>>>> Dick
>>>
>>> 	Thanks. In my case, it as simple as the following:
>>>
>>> 	# iptables -A INPUT -p tcp --dport 22 --source 192.168.0.0/24 -j
>>> ACCEPT
>>>
>>> for host in my internal network.
>>>
>>> 	# iptables -A INPUT -p tcp --dport 22 --source <ip-address> -j
>>> ACCEPT
>>>
>>> where <ip-address> represents a small collection of IP addresses that I
>>> know to be genuine.
>>>
>>> 	# iptables -D INPUT -p tcp --dport 22 -j DROP
>>>
>>> This eliminates all the noise.
>> 
>> Sure. Except it does not work for those of us who seem to spend half
>> their time elsewhere on the globe than at home.
>
> 	Well, for that situation I use an intermediate system, managed by 
> a separate organization, that is accessible from everywhere. I establish 
> an ssh tunnel through it to my own ssh server, and everything works 
> seamlessly.

So then you have to rely on the competence of the people who manage that
intermediate system. They get broken into, and then so you do. It does
not seem much of an security advance.

Back to comp.os.linux.networking | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Increased SSH breakin attempts Harold Johanssen <noemail@please.net> - 2019-04-03 20:17 +0000
  Re: Increased SSH breakin attempts Lew Pitcher <lew.pitcher@digitalfreehold.ca> - 2019-04-03 16:38 -0400
    Re: Increased SSH breakin attempts Harold Johanssen <noemail@please.net> - 2019-04-03 21:13 +0000
      Re: Increased SSH breakin attempts Grant Taylor <gtaylor@tnetconsulting.net> - 2019-04-03 15:23 -0600
    Re: Increased SSH breakin attempts "Carlos E.R." <robin_listas@es.invalid> - 2019-04-03 23:14 +0200
  Re: Increased SSH breakin attempts Dick <rsutton43@comcast.net> - 2019-04-03 17:33 -0400
    Re: Increased SSH breakin attempts Harold Johanssen <noemail@please.net> - 2019-04-03 22:01 +0000
      Re: Increased SSH breakin attempts William Unruh <unruh@invalid.ca> - 2019-04-04 00:27 +0000
        Re: Increased SSH breakin attempts Harold Johanssen <noemail@please.net> - 2019-04-04 14:02 +0000
          Re: Increased SSH breakin attempts William Unruh <unruh@invalid.ca> - 2019-04-04 18:22 +0000
            Re: Increased SSH breakin attempts Harold Johanssen <noemail@please.net> - 2019-04-04 19:15 +0000
  Re: Increased SSH breakin attempts William Unruh <unruh@invalid.ca> - 2019-04-03 21:51 +0000
    Re: Increased SSH breakin attempts Jorgen Grahn <grahn+nntp@snipabacken.se> - 2019-04-05 18:08 +0000
      Re: Increased SSH breakin attempts William Unruh <unruh@invalid.ca> - 2019-04-05 18:45 +0000
        Re: Increased SSH breakin attempts Jorgen Grahn <grahn+nntp@snipabacken.se> - 2019-04-05 22:24 +0000
        Re: Increased SSH breakin attempts Richard Kettlewell <invalid@invalid.invalid> - 2019-04-06 11:40 +0100
          Re: Increased SSH breakin attempts "Carlos E.R." <robin_listas@es.invalid> - 2019-04-06 12:53 +0200
          Re: Increased SSH breakin attempts William Unruh <unruh@invalid.ca> - 2019-04-06 18:13 +0000
            Re: Increased SSH breakin attempts "Carlos E.R." <robin_listas@es.invalid> - 2019-04-06 20:28 +0200
              Re: Increased SSH breakin attempts William Unruh <unruh@invalid.ca> - 2019-04-06 18:54 +0000
              Re: Increased SSH breakin attempts Richard Kettlewell <invalid@invalid.invalid> - 2019-04-07 08:08 +0100
                Re: Increased SSH breakin attempts William Unruh <unruh@invalid.ca> - 2019-04-07 15:43 +0000
                Re: Increased SSH breakin attempts Richard Kettlewell <invalid@invalid.invalid> - 2019-04-07 16:52 +0100

csiph-web