What You Get After Running an SSH Honeypot for 30 Days

Re:What You Get After Running an SSH Honeypot for 30 Days by mistrial9 on Sunday June 16, 2024 @12:47PM (#40698390)

people here are not thinking in whole systems-- roads have dual purpose.. there is security AND there is trade .. a world without trade is a poor world.. that includes the intellectual arts, civilian institutions cooperating, common issues like Climate.

The voices here that say "I block everyone, don't bother me with your whining" .. it is a security practice.. OK. security is not the whole story of civilizations; obstinate thinking leads to ignorance, not evolution.

The topic is SSH, an administrative and secured access. Yes security applies. to be on-topic

[ Parent | on HN ]

Re:What You Get After Running an SSH Honeypot for 30 Days by grishka on Sunday June 16, 2024 @01:06PM (#40698525)

Of course one can obfuscate and secure their own SSH access as much or as little as they want. Run sshd on a different port, require port knocking, ban IPs after failed login attempts, all that kind of stuff.

I'm, however, specifically talking about public-facing services like HTTP(S), which also get blocked with this "I'll just indiscriminately blacklist IPs belonging to countries I don't like" approach.

[ Parent | on HN ]

Re:What You Get After Running an SSH Honeypot for 30 Days by phsau on Sunday June 16, 2024 @01:19PM (#40698614)

Malicious traffic is not limited to ssh and comes from the same usual suspects. Automated attacks against web applications is constant. I wouldn't say it's indiscriminate, it's practical.

[ Parent | on HN ]

Re:What You Get After Running an SSH Honeypot for 30 Days by tmcdos on Tuesday June 18, 2024 @04:37AM (#40715396)

There are bad people on both side of the border - don't be fooled that they are more on the "other" side of the border because there might be ones that you are not seeing (yet). Blocking the whole "other side" is simply the "path of least resistance" or the "low hanging fruit". Creation and all other good things ALWAYS require more energy than destruction and other bad things. But creation/invention is the only activity that leads to progress and evolution - everything else is stalling, regression, devolution ... Internet was created BY military FOR military - but it evolved into THE only thing in the world that connects people. ALL people. References at the bottom.

The most general problem in Internet are not the malicious people - botnets can infect insecure devices ANYWHERE in the world. The main problem is that some (many) of the ISPs at the last mile allow outgoing IP packets with source IP address which is outside of the IP range(s) these ISPs operate/own. Larger ISPs on the upper layer can not prevent this because otherwise IP routing will break. So it all depends on the "last mile" ISPs. And it is quite possible for the "status quo" to live for many years ....

https://www.internetsociety.org/resources/2022/impact-of-ukr... https://labs.ripe.net/author/athina/how-sanctions-affect-the... https://labs.ripe.net/author/farzaneh-badiei/sanctions-and-t... https://www.sciencedirect.com/science/article/pii/S030859612... https://labs.ripe.net/author/moritz_muller/internet-sanction...

[ Parent | on HN ]

Re:What You Get After Running an SSH Honeypot for 30 Days by tiberious726 on Sunday June 16, 2024 @10:05PM (#40701712)

Yeah exactly, try running an esp VPN on a different port and see how well that works.

[ Parent | on HN ]