Hacker News Reader

Comment by jared314 | Hacker News Reader

"Your security is based on the kindness, and apathy, of strangers."

I repeat that warning to anyone who has become just computer-savvy enough to use a computer as well as they drive their car.

The tinfoil-hat jokes have tapered off, over the years, with the mainstream news coverage of stolen user information.

View on HN

Just had a reminder of that this morning... Was doing a bit of routine maintenance on the server at work when I noticed repeated ssh login attempts appearing in the system logs... with usernames that clearly don't exist. Tracing the source ip address sent me to Beijing somewhere, so someone there was trying a port scan and random ssh login attempts.

I've never really looked for this kind of interaction before, and I wonder just how common it is these days - but I'd say that you can now pretty much guarantee that it will happen at some stage, and you'd better hope your security is up to the task.

It even happens if you just open port 22 on your home router. You can use things like fail2ban to put a short-term ban on offending addresses, and put your ssh server on a random (i.e. not 2222) high numbered port to reduce automated scans.

It is so common I'd be surprised if you weren't seeing these login attempts. Every ssh server I've run in the last 10 years has had this happen, even those without domain names. They must just scan random IPv4 addresses for anyone responding on port 22. It's the modern equivalent of wardialing.

I like that paraphrase, mind if I nick it?

Reply on news.ycombinator.com