In the past two weeks I set up a new VPS, and I run a small experiment. I share the results for those who are curious.
Consider that this is a backup server only, meaning that there is no outgoing traffic unless a backup is actually to be recovered, or as we will see, because of sshd.
I initially left the standard “port 22 open to the world” for 4-5 days, I then moved sshd to a different port (still open to the whole world), and finally I closed everything and turned on tailscale. You find a visualization of the resulting egress traffic in the image. Different colors are different areas of the world. Ignore the orange spikes which were my own ssh connections to set up stuff.
Main points:
-
there were about 10 Mb of egress per day due just to sshd answering to scanners. Not to mention the cluttering of access logs.
-
moving to a non standard port is reasonably sufficient to avoid traffic and log cluttering even without IP restrictions
-
Tailscale causes a bit of traffic, negligible of course, but continuous.
You must log in or register to comment.
What software did you use you monitor this? I am newish to self hosting and would like to secure my connection better.
Sorry, it’s the built-in console of Google Cloud. But there are so many monitoring solution around that you can probably find one of your liking. Look on awesome-selfhosted for “monitoring”
Or, you know, just use key auth only and fail2ban. Putting sshd behind another port only buys you a little time.
Yeah but the majority of bots out there are going after easy prey. Honestly, if you use public key authentication with ssh you should be fine, even if it is on port 22. But it does of course clog up access logs.
The majority of bots out there are stopped by just using a hard to guess password. It’s not them that you should be worried about.
who should we be worried about?
The majority of bots doesn’t even show up in the logs if you disable password auth in the server config, as you typically should.
I’ve noticed that a lot of the scans these days almost always switch IPs after 2-3 attempts, making IP blocking a lot more difficult.
Let’s say that you could ban for an indefinitely large amount of time after a single failure to authenticate, that’d make them run out of IPs much quicker than you’d run out of CPU/BW, so I don’t really see the issue
Potentially yeah, although a single failure means I might lock myself out by accident.
True, but very unlikely (once your ssh client is configured once and for all), and in that event you can always switch connection (use a data network, proxy, vpn, hop from another server you have ssh access, etc)
Now try IPv6 only :P
Next time
For management ports, I set up a firewall on the VPS to only respond to connections from known IPs.
You really shouldn’t have something kike SSHD open to the world, that’s just an unnecessary atrack surface. Instead, run a VPN on the server (or even one for a network if you have several servers on one subnet), connect to that then ssh to your server. The advantage is that a well setup VPN simply won’t respond to an invalid connection, and to an attacker, looks just like the firewall dropping the packet. Wireguard is good for this, and easy to configure. OpenVPN is pretty solid too.
You say this and are downvoted.
While we are coming off the tail of Def Con where there where a plethora or small talks and live examples of taking advantage and abusing just this.
I don’t understand your comment, what you are saying. Could you elaborate a bit, please? I’m interested why it’s a bad idea what previous comment suggested.
Of course I can dig into DefCon videos and probably would do if needed, but perhaps you know what exactly the issue is
The first this means the comment he answered to and the second one means ssh being used as an attack surface, being described in defCon talks
Just trying to parse your comment, I assume your first “this” and second “this” are referring to different things, right?
I usually just run a ZeroTier client on my Pi connected to a private P2P network to solve this issue, and then have ProtonVPN over Wireguard for all internet traffic in and out of the Pi.
10mb is pretty much nothing. May as well just use Fail2Ban.
I’ll take that tiny amount of traffic telling scanners there’s no password auth over having to remember port settings for ssh, scp and rsync any day.
For me it’s not about the traffic, more the log spam.
Generally I’ll have :22 enabled internally, and anything non-standard is defined in
~/.ssh/configand shared out so I don’t have to remember things.Fair point. These logs are only useless chatter anyway for everyone with proper key auth.
vim ~/.ssh/configdeleted by creator
My configs remember stuff for me.
Is public key authentication not good enough? Tailscale is cool but can be tedious if you also use other VPNs
Yeah that’s what I have too. One of my servers is exposed with key auth and I just tunnel to other servers from there. A few MB egress is nothing compared with the amount of spam my webserver needs to deal with
And yet it is more likely that tailscale get owned since the reward is much higher. I take my chances with my secured openssh server at port 22 vs a 3rd party company who controlls the access.
Just setup a wireguard system that’s pretty bulletproof
So is SSH
Wireguard doesn’t respond but I agree open-ssh is pretty solid. Can’t speak for any of the other ssh implementations. It can also be poorly configured. Like you could use a password
The benefit of Wireguard is that if you screw it up, it just won’t work. It basically enforces security.
Well, unless you tried to use the original PFSense module.
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters DNS Domain Name Service/System HTTP Hypertext Transfer Protocol, the Web IP Internet Protocol SSH Secure Shell for remote terminal access UDP User Datagram Protocol, for real-time communications VPN Virtual Private Network VPS Virtual Private Server (opposed to shared hosting) nginx Popular HTTP server
7 acronyms in this thread; the most compressed thread commented on today has 8 acronyms.
[Thread #42 for this sub, first seen 14th Aug 2023, 15:55] [FAQ] [Full list] [Contact] [Source code]
Good bot!
Great bot
Throw CrowdSec on there to stop the bots before they can do anything
Public key auth, and fail2ban on an extremely strict mode with scaling bantime works well enough for me to leave 22 open.
Fail2ban will ban people for even checking if the port is open.
Yeah fail2ban has worked great for me
If Fail2Ban is so important, why the h*** does it not come installed and enabled as standard?!
Security is the number-1 priority for any OS, and yet stock SSHD apparently does not have Fail2Ban-level security built in. My conclusion is that Fail2Ban cannot therefore be that vital.
Honest question, is there a good default config available somewhere or is what
apt install fail2bandoes good to go? All the tutorials I’ve found have left it to the reader to configure their own rules.Honestly the default config is good enough to prevent brute force attacks on ssh. Just installing it and forgetting about it is a definite option.
I think the default block time is 10 minutes after 5 failed login attempts in 10 minutes. Not enough to ever be in your way but enough to fustrate any automated attacks. And it’s got default config for a ton of services by default. Check your /etc/fail2ban/jail.conf for an overview.
I see that a recidive filter that bans repeat offenders for a week after 10 fail2ban bans in one day is also default now. So I’d say that the results are perfect unless you have some exotic or own service you need fail2ban for.
ITT: People who don’t understand Tailscale or are allergic to it for ‘reasons’
Whys this a problem disable password auth and wish em good luck lol.
I opened a raw text channel on the Telnet port for a personal game engine project and someone tried to enable commands and do some shady stuff. Unfortunately for them, that’s not a valid chess move.
