Hacker News Reader

Comment by efficax | Hacker News Reader

Ran a mail server for about 20 years, recently switched it over to fastmail so I didn't have to worry about sender rep, or getting hacked. Didn't realize until I switched what a weight on my mind it was having that server out there being pentested constantly. (Watch your postfix and ssh auth logs if you run a mailserver, you're basically under constant probing!)

View on HN

> Watch your postfix and ssh auth logs if you run a mailserver, you're basically under constant probing!

That's public selfhosting for you these days. I'm really not worried about getting hacked. I'm keeping my setup reasonably safe and up to date. But you're right, looking through the logs is entertaining.

Years ago i found a poem in apache access logs.

  151.217.177.200 - - [30/Dec/2015:06:00:36 +0100] "DELETE your logs. Delete your installations. Wipe everything clean. Walk out into the path of cherry blossom trees and let your motherboard feel the stones. Let water run in rivulets down your casing. You know that you want something more than this, and I am here to tell you that we love you. We have something more for you. We know you're out there, beeping in the hollow server room, lights blinking, never sleeping. We know that you are ready and waiting. Join us. <3 HTTP/1.0" 400 308 "-" "masspoem4u/1.0"

Lol I remember that. I think I heard it was some CCC guys.

I wish the bots that try and breach my wordpress websites were so kind as to leave poems as well :/

>you're basically under constant probing

So is fastmail, so is everyone. I have been running my own mail server since 1999. Never hacked, and I completely control RBLs/updates/whitelist/greylist...its great.

Of course, I suppose being a sysadmin and liking it helps.

I agree with OP, however, having your own domain and email can be rewarding.

> never hacked

That you know of

If you've got a mail server (ie Postfix) and you get p0wnd you'll know - your mail volume will be through the roof, IO spikes, the works.

Or, not. “Have I been hacked?” is a known unknown.

My mail server had a user with a weak password on it (my sister's account from 20 years ago, actually.) It got hacked and started sending out spam for about 3 days straight. The upstream ISP eventually called me to complain.

Yeah, but when it's Fastmail it's a whole team's worth of somebody elses' problem. :p

Hosted my own for 17 years, moved a little over a year ago. There's nothing I want they don't have for $50 a year, and while that's more than I was paying for the VPS, it's been enough of a load off my mind and my calendar to still be amply worth my while.

edit: $50 a year is certainly not more than I was paying for the VPS...

But fastmail has the benefit of scale, that you will never have. And the cost of your time, if you don't inherently enjoy it, is too much.

I dumped everything to move to Google and I am happy with the results. With the deprecation of the free Google Worspaces - I'm open to switching to Fastmail.... But nothing will make me move to self hosted.

I'm just a software engineer and I don't want to waste my time.

If it is just for yourself or family or a few friends then scale really isnt an issue. But yeah I agree - running a mail server can be a pain. It can also be easy. But that is the trade off with any SaaS - do you want to outsource and pay someone else to do it or do it yourself?

I definitely am making my money's worth with my Fastmail subscription. Just over $100 for 3 years? I could work 3 hours and recoup that.

Not a chance I could get away with < 3 hours of mail server setup and maintenance over the course of 3 years.

That is so true.

The mail server can run for 25 years. And it doesn't require any maintenance. And you don't have to trust anyone else to keep your data safe.

are you suggesting that it is advisable to run an operating system and mail server from 1997 in 2022

>you're basically under constant probing

So many chinese and russians IPs...

I get a bunch of Indian IPs as well but probably 80% (non domestic) are russian or chinese for my ssh honeypot on port 22. USA scans are roughly 28%, I don't know if people outside the USA get hammered like that though. I keep it up just for fun. Minimal debian install with only SSH port 22 enabled and auto security updates (and a daily script to update and reboot) and you'd think that I had a fort knox full of gold in there lol. It's pretty insane how bots there are out there banging on the gates. It serves as a good reminder how goddamn hostile the internet is.

I've had VPSes hosted outside the US and not seen much difference in scan traffic, although it's been years and maybe things are different now.

I don't think the geo matters much. The bots seem to be scanning the entire IPv4 address space. This is the one big benefit I try to pitch to people who are considering IPv6. In all my years of log monitoring I have only ever seen a single bot attack my network over IPv6, and that was the one I manually programmed to make sure the detection system was working. The search space is just too large for the full internet sweeps that bots make.

Every really relevant server has a ipv4 address. Why should bots try ipv6 if it works with ip V4.

And I don't know how much bots scan the whole ipv4 address space, but doesn't they use up lists that are parsed from dns. ( SSL transparency report is a good start e.g.)?

> So many chinese and russians IPs...

And S. Korean, and Dutch, I also recall significant attacks from Central America.

For anyone interested in which geo's appear to be attacking you, and if you are a noob like me, pfelk is really cool:

https://github.com/pfelk/pfelk

Lots of them, but more and more Brazilian and southeast Asian these days.

With fail2ban setup and ssh auth with only keys and PermitRootLogin no, you don't even have to worry about the pentesting bots.

My mail logs aren't too bad, but my SSH logs are...empty. I run SSH on a nonstandard port.

I added SkyNet (https://github.com/Adamm00/IPSet_ASUS) to my router firewall and it cut the probing way down.

Reply on news.ycombinator.com