Hacker News Reader

Comment by zippergz | Hacker News Reader

Why do people think it's worthwhile to file abuse complaints about port 22 connections? If I wanted to file a complaint about every random connection to port 22 on one of my machines, it would be a full time job...

View on HN

Don't manually file them in that case. Install Fail2ban and automatically ban anyone with x failed attempts, and have it email fail2ban@blocklist.de. Their system will look up the correct abuse department, and forward it along on your behalf, along with thousands of others that report it. A large portion of them probably go ignored, but if you can get a fraction of them taken offline, then why not spend the five minutes to set it up?

The bottom half of http://spenserj.com/blog/2013/07/15/securing-a-linux-server/ shows how few things you need to do to set up Fail2ban and Blocklist.de

My scanner doesn't try to brute-force the logins. It's just grabbing the banner.

Well, if you had a "class A" address space, you would have seen 16777216 connection attempts in your firewall logs. Yeah, I imagine that would be a full time job.

A lot of 'rouge' ssh traffic comes from hacked machines. If you contact the abuse department of a provider, they may get in touch with the owner of the machine to let them know that their box has been compromised.

Yes I know that, but I'm not convinced that the cost/benefit really makes sense for complaining. Back in my more idealistic days I did report a lot of abuse. But it's so rare for the recipient to actually do anything about it, and the volume of scans so high, it's just not worth my time.

> A lot of 'rouge' ssh traffic comes from hacked machines.

And they're owned by the Hell's Angles or Red China, I bet.

Rouge Angles of Satin

Reply on news.ycombinator.com