Hacker News Reader

Comment by 29athrowaway | Hacker News Reader

Using ssh in an obscure port helps a little bit.

PAM modules also help.

This particular malware doesn't seem to grok when you're using certs or keys, so while it'll never be successful it keeps trying (effectively a resource DOS).

Obscure port does nothing.. it eventually finds it and then you'll see tons of servers try that port (unless you constantly move it).

I'm not sure how you imagine Pluggable Authentication Modules would help? Fail2Ban or some sort of active IPS helps, but because the IPs are very varied (and presumably ever increasing) and infrequently re-attempt it doesn't help much.

Note anyone running exposed SSH without keys or certs, should run the detection script[0] (which is just shell and you should read first before installing) provided by Guardicore

[0]: https://github.com/guardicore/labs_campaigns/tree/master/Fri...

For my hobby servers, I listen on a non standard port. Not once in 20+ years has anything hit that port. Even when I've had domains / sites that ruffled feathers, no hits. It most certainly cuts out noise in logs and stops all the bots.

I've also used a port other than 22 for sshd. And I can confirm that the past month I've been getting hit with lots of failed login attempts on ssh. My basic look at the logs shows it trying random dictionary words for usernames. And every connection attempt comes from a different IP.

Yes, I'm seeing the same to my non-standard port and the connection attempts are from a large number of different addresses (and only usually 1 or 2 attempts from each) that Fail2Ban does not trigger.

A few months ago I started noticing failed login attempts on my non standard SSH port (> port 1024) so I moved it up a few port numbers. About 2-3 weeks ago, I noticed that it was getting hit again by failed login attempts. I then changed the port to the original and immediately started getting login attempts again... it kind of spooked me.

I thought about using fail2ban but every login is a different IP (using my eyeballs, I didn't parse the logs).

I take a different approach than fail2ban. My sftp servers use a standard port 22 and any time people try to log in, I create an account for them automatically via a cron job in the sftp-only group and a null password. The bots will spend years trying to log in repeatedly every few minutes. I have yet to see them upload anything interesting. Many years ago, bots would upload malware, then try to browse to it on port 80. But no more... These bots just want to get a shell and install malware / c&c tools. Some of them try port forwarding, but I have that restricted for the sftp users.

You can still use fail2ban to block unique IP addresses if you use some supporting scripting. There's an example ([1]), which will check the IP addresses by country code. If they're all the same country then you can just block the whole country.

You do not need to use firewalld, either, although this does. See the second link for something generic ([2]).

[1] https://pagure.io/firewalld-blacklist/tree/master

[2] https://www.linuxjournal.com/content/advanced-firewall-confi...

Reply on news.ycombinator.com