Hacker News Reader

Comment by vadfa | Hacker News Reader

Cloudflare has a VPN product, WARP. It's possible that they are clients of theirs doing the scanning.

In any case I wouldn't think much of it. If you obsess over any garbage traffic you get you will go insane.

Maybe that's a case, but their abuse team hasn't replied anything in a 2 weeks about that after I gave them all timestamps and both source/destination IP addresses

They won't disconnect clients over SSH scanning. That's a ridiculous expectation. It's 2021. Nobody cares.

What kind of answer would you expect, in all seriousness? The thing you are reporting is not illegal or even dodgy.

I expect to hear who (and why) generates that kind of traffic from cloudflare owned subnets.

I can understand your frustration with background internet noise, but please note Cloudflare is not known for broadcasting their customers' names to the first abuse report with a pcap of a TCP handshake.

There may be more realistic ways to go about protecting people's SSH servers that trying to dox Cloudflare VPN users.

Who's trying to dox those users?

I assumed OP wants to know the identity of the Cloudflare users scanning their SSH ports.

I think OP guessed it was probably not Cloudflare themselves scanning their ports, so I think that's what they meant by "hear who and why".

Maybe dox is too strong a word. My point is, from what I've heard, the general sentiment is that you're unlikely to get any information about customers just by sending abuse reports to Cloudflare.

OP obviously simply expected at least an explanation on the cause of these ssh connection probes. He got the explanation here (VPN).

I can‘t understand it. There doesn‘t appear to be any downside or even abuse happening. The fact OP expects a company to explain who and why a customer of theirs did a legal non abusive act is just an outstanding level of entitlement.

VPS and VPN providers should be very mindful of their reputation in this regard. If they get a reputation as a "black hole" where complaints vanish and nothing ever happens, the effect may be that other customers start to find themselves blocked or throttled on a subnet level.

I don’t know of any provider that would take action on reports of ssh scanning.

A little bird told me a story that AWS will forward abuse reports to customers performing outbound nmap scans.

I report them from time to time. I'm not sure why people don't take them seriously. If 500 people a day came up to your front door and tried the knob, hell maybe even tried a couple of keys in the lock... I'm pretty sure you'd be calling the cops.

An ssh server isn’t really like a front door though. I don’t necessarily think attempting a random ssh server should be a crime.

I used to spend time on custom iptables scripts but came to the conclusion it’s much better to just architect things in a way where the bots and scanners can’t plausibly create a problem and then ignoring them.

I don’t think anyone is about to block or throttle traffic from Cloudflare IP ranges.

Incoming connections? Why not. I have at times, it's pretty great.

https://twitter.com/IamRageSparkle/status/128089153745134387...

If your ISP and the server support IPv6, just disable SSH on IPv4.

Some of my servers don't even have any IPv4 connectivity and there haven't been any failed SSH logins over IPv6.

My OpenSSH is located on a non standard port, 22/tcp is going to the endlessh honeypot.

Not to disappoint you, but except for logging SSH honeypots are becoming useless (most bots automatically disconnect when they detect a long login banner).

So should I add a long banner to my server to disguise it as a honey pot, just in case?

I mean, I'm not sure that you can do that with OpenSSH though (short of recompiling it, which I do not recommend unless you're a company).

> endlessh honeypot.

*tarpit

A honeypot lets people "in" to see/research malware that's in the wild:

* https://en.wikipedia.org/wiki/Honeypot_(computing)

A tarpit just takes up the attacker's resources:

* https://en.wikipedia.org/wiki/Tarpit_(networking)

Not what most people run, but SSH honeypots are also useful:

https://lwn.net/Articles/848291/

I like this solution a lot!

It could also be used for IP reputation, running ssh can be a sign of a proxy or other server/service that website owners might want to block.

I think single SYN packet would be enough to know whether this port open or not, but they trying to gather full banner.

Reply on news.ycombinator.com