I looked through attacks in my access logs

Re:I looked through attacks in my access logs by TacticalCoder on Sunday January 28, 2024 @08:45PM (#39171885)

Just to reduce the crap in the log and also because I can, I have my SSH servers (not saying what their IPs are) using a very effective measure: traffic is dropped from the entire world, except for the CIDR blocks, which I put in ipsets, of the five ISPs over three countries I could reasonably be in when I need to access the SSH servers.

And if I'm really, say, in China or Russia an really need to access one of my servers through SSH, I can use a jump host in one of the three countries that I allow.

So effectively: DROPping traffic from 98% of the planet.

Boom.

[ Parent | on HN ]

Re:I looked through attacks in my access logs by bradknowles on Sunday January 28, 2024 @09:34PM (#39172106)

Deny by default, allow only those sources that are considered trustworthy. And frequently re-evaluate who and what should be considered trustworthy.

[ Parent | on HN ]

Re:I looked through attacks in my access logs by aborsy on Sunday January 28, 2024 @11:47PM (#39172789)

Or close the ports, and install an agent that phones out such as Tailscale or twingate.

[ Parent | on HN ]

Re:I looked through attacks in my access logs by Fnoord on Monday January 29, 2024 @02:34AM (#39173724)

Or just Wireguard itself.

[ Parent | on HN ]

Re:I looked through attacks in my access logs by PLG88 on Monday January 29, 2024 @04:10AM (#39174297)

This is the way, outbound only connections so you can stop all external unauthenticated attacks. I wrote a blog 2 years back comparing zero trust networking using Harry Potter analogies... what we are describing is making our resources 'invisible' to silly muggles - https://netfoundry.io/demystifying-the-magic-of-zero-trust-w...

[ Parent | on HN ]

Re:I looked through attacks in my access logs by Fnoord on Monday January 29, 2024 @02:33AM (#39173719)

I don't want to be able to auth whilst physically in authoritarian regimes. If I had to be physically there it'd be via burner devices.

[ Parent | on HN ]