How do you know this? What tool or utility tells you this fact? I have a port exposed for a game server but realising I don’t know how many attempts are being made.
I was kinda new to linux so I used https://www.papertrail.com/ and hooked it up to my syslogs, and then went “oh… oh no… oh god no…” and immediately turned off SSH.
Yeah, BBC has a whole documentary about it. Plus the russian state department basically published it all in a propaganda manual. They don’t exactly try to hide this stuff…
yeah, while reading this i was going “What maniac exposes SSH to WAN anyway…?” the whole time. I fail to see any reason or point that can be justified exposing SSH to WAN.
I used to have a synology NAS that would sleep of death itself. Synology support asked me to port forward SSH to the open internet and set no password so they could pull logs over the next few weeks.
Any VPS provider just gives you an SSH IP and port. So that’s the default state, until you do something else, which I imagine many don’t, since key based authentication was always considered secure.
So I don’t know the reason, but that’s the standard practice with most providers, like Digital Ocean or Linode or whatever. You can call them maniacs but you shouldn’t be surprised at something so ubiquitous.
Yeah it’s crazy. Are they just constantly pinging every possible ip address on every possible port every second? I opened a port for 1 day and the traffic made me uncomfortable enough to rearchitecture my entire self host setup
The only time I ever exposed my SSH port to the WAN, I got about 750 connection attempts from China and 250 attemps from Russia per hour.
One reason that I have my router ignore all connection attempts from Russia and China
Fail2ban with increasing jail time for repeat offenders usually takes care of the worst of it after a day or two
How do you know this? What tool or utility tells you this fact? I have a port exposed for a game server but realising I don’t know how many attempts are being made.
I was kinda new to linux so I used https://www.papertrail.com/ and hooked it up to my syslogs, and then went “oh… oh no… oh god no…” and immediately turned off SSH.
Thank you kindly, I am reasonably new to Linux myself. Ibuse it but don’t have a great understanding
For ssh it’ll log out to the auth log at /var/log/auth.log
Among other things, change the default ssh port to something way higher.
Did it help you find hot milfs within a mile of your location?
Surprised me too, it’s even worse if you use a cloud host for a VPS since it’ll be a more known IP
Yet some people will still say with a straight face “tHeRe iS nO hYbRiD wAr!1!1”
Not in Ba Sing Se at least…
This was about 20 years ago btw. I know it’s gotten worse. But it started earlier than most think.
Yeah, BBC has a whole documentary about it. Plus the russian state department basically published it all in a propaganda manual. They don’t exactly try to hide this stuff…
yeah, while reading this i was going “What maniac exposes SSH to WAN anyway…?” the whole time. I fail to see any reason or point that can be justified exposing SSH to WAN.
I used to have a synology NAS that would sleep of death itself. Synology support asked me to port forward SSH to the open internet and set no password so they could pull logs over the next few weeks.
Yes, it was legit synology support not a scammer.
No, I haven’t bought synology ever again.
What do you use now? Qnap?
I build my own stuff now. I tried qnap after synology but it just sucked in different ways.
Any VPS provider just gives you an SSH IP and port. So that’s the default state, until you do something else, which I imagine many don’t, since key based authentication was always considered secure.
So I don’t know the reason, but that’s the standard practice with most providers, like Digital Ocean or Linode or whatever. You can call them maniacs but you shouldn’t be surprised at something so ubiquitous.
New friends from all over the world!
99.999% of that is over IPv4. I leave IPv6 open to WAN for my own use and it’s not a problem.
Thanks for the intel
Yeah it’s crazy. Are they just constantly pinging every possible ip address on every possible port every second? I opened a port for 1 day and the traffic made me uncomfortable enough to rearchitecture my entire self host setup