How do you know this? What tool or utility tells you this fact? I have a port exposed for a game server but realising I don’t know how many attempts are being made.
I was kinda new to linux so I used https://www.papertrail.com/ and hooked it up to my syslogs, and then went “oh… oh no… oh god no…” and immediately turned off SSH.
Yeah, BBC has a whole documentary about it. Plus the russian state department basically published it all in a propaganda manual. They don’t exactly try to hide this stuff…
And we’ve caught them doing it. Again, and again, and again. Also they are waging a literal war against Europe and treat their own population basically the same as they do their enemies.
Yeah but thank god for the aNtI-wEsT tankies who so enthusiastically push kremlin-sponsored talking points night and day to liberate us from our… democratically-elected oppressors, or something?
/s, of course
I mean I get it, the west isn’t perfect. But compared to russia, most western countries don’t seem so bad.
And we’d be much better off by now if they would stop meddling in our elections (i.e. by funding reactionaries and running manipulative social media campaigns) and keep their filthy psyops out of our zeitgeist
yeah, while reading this i was going “What maniac exposes SSH to WAN anyway…?” the whole time. I fail to see any reason or point that can be justified exposing SSH to WAN.
I used to have a synology NAS that would sleep of death itself. Synology support asked me to port forward SSH to the open internet and set no password so they could pull logs over the next few weeks.
Any VPS provider just gives you an SSH IP and port. So that’s the default state, until you do something else, which I imagine many don’t, since key based authentication was always considered secure.
So I don’t know the reason, but that’s the standard practice with most providers, like Digital Ocean or Linode or whatever. You can call them maniacs but you shouldn’t be surprised at something so ubiquitous.
The only time I ever exposed my SSH port to the WAN, I got about 750 connection attempts from China and 250 attemps from Russia per hour.
Fail2ban with increasing jail time for repeat offenders usually takes care of the worst of it after a day or two
One reason that I have my router ignore all connection attempts from Russia and China
Russia, China, India, NK should be on all block lists
What if they use VPNs? THEN WHAT?!
Did it help you find hot milfs within a mile of your location?
Among other things, change the default ssh port to something way higher.
How do you know this? What tool or utility tells you this fact? I have a port exposed for a game server but realising I don’t know how many attempts are being made.
I was kinda new to linux so I used https://www.papertrail.com/ and hooked it up to my syslogs, and then went “oh… oh no… oh god no…” and immediately turned off SSH.
Thank you kindly, I am reasonably new to Linux myself. Ibuse it but don’t have a great understanding
Ibusing it is how you learn it.
For ssh it’ll log out to the auth log at /var/log/auth.log
Surprised me too, it’s even worse if you use a cloud host for a VPS since it’ll be a more known IP
Yet some people will still say with a straight face “tHeRe iS nO hYbRiD wAr!1!1”
Not in Ba Sing Se at least…
This was about 20 years ago btw. I know it’s gotten worse. But it started earlier than most think.
Yeah, BBC has a whole documentary about it. Plus the russian state department basically published it all in a propaganda manual. They don’t exactly try to hide this stuff…
And we’ve caught them doing it. Again, and again, and again. Also they are waging a literal war against Europe and treat their own population basically the same as they do their enemies.
So there’s that hard physical evidence and proof…
Yeah but thank god for the aNtI-wEsT tankies who so enthusiastically push kremlin-sponsored talking points night and day to liberate us from our… democratically-elected oppressors, or something?
/s, of course
I mean I get it, the west isn’t perfect. But compared to russia, most western countries don’t seem so bad.
And we’d be much better off by now if they would stop meddling in our elections (i.e. by funding reactionaries and running manipulative social media campaigns) and keep their filthy psyops out of our zeitgeist
99.999% of that is over IPv4. I leave IPv6 open to WAN for my own use and it’s not a problem.
Thanks for the intel
yeah, while reading this i was going “What maniac exposes SSH to WAN anyway…?” the whole time. I fail to see any reason or point that can be justified exposing SSH to WAN.
I used to have a synology NAS that would sleep of death itself. Synology support asked me to port forward SSH to the open internet and set no password so they could pull logs over the next few weeks.
Yes, it was legit synology support not a scammer.
No, I haven’t bought synology ever again.
What do you use now? Qnap?
I build my own stuff now. I tried qnap after synology but it just sucked in different ways.
Any VPS provider just gives you an SSH IP and port. So that’s the default state, until you do something else, which I imagine many don’t, since key based authentication was always considered secure.
So I don’t know the reason, but that’s the standard practice with most providers, like Digital Ocean or Linode or whatever. You can call them maniacs but you shouldn’t be surprised at something so ubiquitous.
New friends from all over the world!