Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #4347

Re: Increased SSH breakin attempts

Show all headers | View raw

On Thu, 04 Apr 2019 18:22:03 +0000, William Unruh wrote:

> On 2019-04-04, Harold Johanssen <noemail@please.net> wrote:
>> On Thu, 04 Apr 2019 00:27:06 +0000, William Unruh wrote:
>>
>>> On 2019-04-03, Harold Johanssen <noemail@please.net> wrote:
>>>> On Wed, 03 Apr 2019 17:33:46 -0400, Dick wrote:
>>>>
>>>>> On 4/3/2019 4:17 PM, Harold Johanssen wrote:
>>>>>> 	For a while now I have noticed a significant increase in brute-
>>>>>> force password breaking attempts at my SSH server exposed to the
>>>>>> Internet. There has always been traffic like that there, but it has
>>>>>> recently become far more voluminous than usual: my domain is a
>>>>>> nondescript one, with nothing much interesting, and it is
>>>>>> registering such attempts to the tune of several per minute, when
>>>>>> it used to be more like one, maybe two, per minute.
>>>>>> 
>>>>>> 	The attempts are coming from lots of different IP addresses all
>>>>>> over the place, but I wonder if it is a single bot controlling
>>>>>> thousands of different PCs? Anyway, has anybody noticed a similarly
>>>>>> recent traffic increase in their exposed SSH interfaces?
>>>>>> 
>>>>>> 
>>>>> Even though you didn't ask for possible solutions, I use FailToBan.
>>>>> Like you, I had all kinds of log noise on port 22, so I too, picked
>>>>> a random high number port. That cleared up most of the log noise,
>>>>> but by using failtoban, it manipulates iptables such that you can
>>>>> simply set retry counts, over a given time span, and automatically
>>>>> block would be intruders for a number of minutes.  It actually
>>>>> solved my problem because I only use the external ssh port when I'm
>>>>> traveling (using certificates).
>>>>> 
>>>>> It's just a suggestion to look into and it solved my use case.
>>>>> Dick
>>>>
>>>> 	Thanks. In my case, it as simple as the following:
>>>>
>>>> 	# iptables -A INPUT -p tcp --dport 22 --source 192.168.0.0/24 -j
>>>> ACCEPT
>>>>
>>>> for host in my internal network.
>>>>
>>>> 	# iptables -A INPUT -p tcp --dport 22 --source <ip-address> -j
>>>> ACCEPT
>>>>
>>>> where <ip-address> represents a small collection of IP addresses that
>>>> I know to be genuine.
>>>>
>>>> 	# iptables -D INPUT -p tcp --dport 22 -j DROP
>>>>
>>>> This eliminates all the noise.
>>> 
>>> Sure. Except it does not work for those of us who seem to spend half
>>> their time elsewhere on the globe than at home.
>>
>> 	Well, for that situation I use an intermediate system, managed by
>> a separate organization, that is accessible from everywhere. I
>> establish an ssh tunnel through it to my own ssh server, and everything
>> works seamlessly.
> 
> So then you have to rely on the competence of the people who manage that
> intermediate system. They get broken into, and then so you do. It does
> not seem much of an security advance.

	In my case, I have no reason to doubt the competence of those who 
manage that intermediate system, and I have lots of evidence to think 
that they know their way around these issues better than myself. My goal 
was to prevent junk data from appearing in my logs. I am satisfied that 
the security aspects are already well taken care of.

Back to comp.os.linux.networking | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Increased SSH breakin attempts Harold Johanssen <noemail@please.net> - 2019-04-03 20:17 +0000
  Re: Increased SSH breakin attempts Lew Pitcher <lew.pitcher@digitalfreehold.ca> - 2019-04-03 16:38 -0400
    Re: Increased SSH breakin attempts Harold Johanssen <noemail@please.net> - 2019-04-03 21:13 +0000
      Re: Increased SSH breakin attempts Grant Taylor <gtaylor@tnetconsulting.net> - 2019-04-03 15:23 -0600
    Re: Increased SSH breakin attempts "Carlos E.R." <robin_listas@es.invalid> - 2019-04-03 23:14 +0200
  Re: Increased SSH breakin attempts Dick <rsutton43@comcast.net> - 2019-04-03 17:33 -0400
    Re: Increased SSH breakin attempts Harold Johanssen <noemail@please.net> - 2019-04-03 22:01 +0000
      Re: Increased SSH breakin attempts William Unruh <unruh@invalid.ca> - 2019-04-04 00:27 +0000
        Re: Increased SSH breakin attempts Harold Johanssen <noemail@please.net> - 2019-04-04 14:02 +0000
          Re: Increased SSH breakin attempts William Unruh <unruh@invalid.ca> - 2019-04-04 18:22 +0000
            Re: Increased SSH breakin attempts Harold Johanssen <noemail@please.net> - 2019-04-04 19:15 +0000
  Re: Increased SSH breakin attempts William Unruh <unruh@invalid.ca> - 2019-04-03 21:51 +0000
    Re: Increased SSH breakin attempts Jorgen Grahn <grahn+nntp@snipabacken.se> - 2019-04-05 18:08 +0000
      Re: Increased SSH breakin attempts William Unruh <unruh@invalid.ca> - 2019-04-05 18:45 +0000
        Re: Increased SSH breakin attempts Jorgen Grahn <grahn+nntp@snipabacken.se> - 2019-04-05 22:24 +0000
        Re: Increased SSH breakin attempts Richard Kettlewell <invalid@invalid.invalid> - 2019-04-06 11:40 +0100
          Re: Increased SSH breakin attempts "Carlos E.R." <robin_listas@es.invalid> - 2019-04-06 12:53 +0200
          Re: Increased SSH breakin attempts William Unruh <unruh@invalid.ca> - 2019-04-06 18:13 +0000
            Re: Increased SSH breakin attempts "Carlos E.R." <robin_listas@es.invalid> - 2019-04-06 20:28 +0200
              Re: Increased SSH breakin attempts William Unruh <unruh@invalid.ca> - 2019-04-06 18:54 +0000
              Re: Increased SSH breakin attempts Richard Kettlewell <invalid@invalid.invalid> - 2019-04-07 08:08 +0100
                Re: Increased SSH breakin attempts William Unruh <unruh@invalid.ca> - 2019-04-07 15:43 +0000
                Re: Increased SSH breakin attempts Richard Kettlewell <invalid@invalid.invalid> - 2019-04-07 16:52 +0100

csiph-web