this post was submitted on 14 Aug 2023
2 points (100.0% liked)

Selfhosted

39824 readers
643 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
HybridSarcasm@lemmy.world
HybridSarcasm@lemmy.hybridsarcasm.xyz
2
Another good reason not to open port 22 (lemmy.world)
submitted 1 year ago by aesir@lemmy.world to c/selfhosted@lemmy.world
41 comments fedilink hide all child comments
 

In the past two weeks I set up a new VPS, and I run a small experiment. I share the results for those who are curious.

Consider that this is a backup server only, meaning that there is no outgoing traffic unless a backup is actually to be recovered, or as we will see, because of sshd.

I initially left the standard "port 22 open to the world" for 4-5 days, I then moved sshd to a different port (still open to the whole world), and finally I closed everything and turned on tailscale. You find a visualization of the resulting egress traffic in the image. Different colors are different areas of the world. Ignore the orange spikes which were my own ssh connections to set up stuff.

Main points:

  • there were about 10 Mb of egress per day due just to sshd answering to scanners. Not to mention the cluttering of access logs.

  • moving to a non standard port is reasonably sufficient to avoid traffic and log cluttering even without IP restrictions

  • Tailscale causes a bit of traffic, negligible of course, but continuous.

top 41 comments
sorted by: hot top controversial new old
[–] Decronym@lemmy.decronym.xyz 5 points 1 year ago* (last edited 3 months ago) (1 children)

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

Fewer Letters More Letters
DNS Domain Name Service/System
HTTP Hypertext Transfer Protocol, the Web
IP Internet Protocol
SSH Secure Shell for remote terminal access
UDP User Datagram Protocol, for real-time communications
VPN Virtual Private Network
VPS Virtual Private Server (opposed to shared hosting)
nginx Popular HTTP server

7 acronyms in this thread; the most compressed thread commented on today has 8 acronyms.

[Thread #42 for this sub, first seen 14th Aug 2023, 15:55] [FAQ] [Full list] [Contact] [Source code]

[–] sircac@lemmy.world 1 points 1 year ago

Good bot!

[–] James@lemmy.ca 3 points 1 year ago (2 children)

Public key auth, and fail2ban on an extremely strict mode with scaling bantime works well enough for me to leave 22 open.

Fail2ban will ban people for even checking if the port is open.

[–] timi@lemmy.world 1 points 1 year ago

Honest question, is there a good default config available somewhere or is what apt install fail2ban does good to go? All the tutorials I’ve found have left it to the reader to configure their own rules.

[–] JubilantJaguar@lemmy.world -1 points 1 year ago

If Fail2Ban is so important, why the h*** does it not come installed and enabled as standard?!

Security is the number-1 priority for any OS, and yet stock SSHD apparently does not have Fail2Ban-level security built in. My conclusion is that Fail2Ban cannot therefore be that vital.

[–] muntedcrocodile@lemm.ee 1 points 3 months ago

Whys this a problem disable password auth and wish em good luck lol.

[–] Feathercrown@lemmy.world 1 points 1 year ago

I opened a raw text channel on the Telnet port for a personal game engine project and someone tried to enable commands and do some shady stuff. Unfortunately for them, that's not a valid chess move.

[–] wgs@lemmy.sdf.org 1 points 1 year ago (2 children)

I get what you say, and you're definitely not wrong to do it. But as I see it, you only saved ~80Kib of ingress and a few lines of logs in the end. From my monitoring I get ~5000 failed auth per day, which account for less than 1Mbps average bandwidth for the day.

It's not like it's consuming my 1Gbps bandwidth or threatening me as I enforce ssh key login. I like to keep things simple, and ssh on port 22 over internet makes it easy to access my boxes from anywhere.

[–] aesir@lemmy.world 1 points 1 year ago* (last edited 1 year ago) (1 children)

ssh -p 12345 would leave your boxes accessible from anywhere too. Other blocks of IPs receive 10 times or more requests, as scanners can focus on blocks of ips from major providers.

[–] wgs@lemmy.sdf.org -1 points 1 year ago

Yeah I know, I just don't really care about that traffic to bother changing it :) Also, I'm talking about a server hosted on Hetzner, so I feel like it's scanned a lot.

[–] oatscoop@midwest.social 1 points 1 year ago* (last edited 1 year ago) (1 children)

I don't get why people leave interfaces the public doesn't need access to open to the public -- especially SSH.

Use a VPN if you need access to those interfaces from the "outside". They're stupidly easy to set up these days, particularly with Wireguard.

[–] wgs@lemmy.sdf.org -1 points 1 year ago

A VPN is easy to setup (and I have it setup by the way), but no VPN is even easier. SSH by itself is sufficiently secure if you keep it up to date with a sane configuration. Bots poking at my ssh port is not something that bother me at all, and not part of any attack vector I want to be secure against.

Out of all the services I expose to the clear web, SSH is probably the one I trust the most.

[–] spagnod@lemmy.world 1 points 1 year ago (1 children)

Just do it properly and configure sshd securely. When you have a machine exposed to the internet, you should expect it to be attacked. If you really want to give the finger to bots, run endlessh on port 22 and keep sshd on a non-standard port. Stay safe.

[–] Feathercrown@lemmy.world 2 points 1 year ago

endlessh

Lmao thanks for this

[–] u_tamtam@programming.dev 1 points 1 year ago (1 children)

Or, you know, just use key auth only and fail2ban. Putting sshd behind another port only buys you a little time.

[–] nomadjoanne@lemmy.world 1 points 1 year ago (1 children)

Yeah but the majority of bots out there are going after easy prey. Honestly, if you use public key authentication with ssh you should be fine, even if it is on port 22. But it does of course clog up access logs.

[–] marcos@lemmy.world 1 points 1 year ago (1 children)

The majority of bots out there are stopped by just using a hard to guess password. It's not them that you should be worried about.

[–] aard@kyu.de 1 points 1 year ago

The majority of bots doesn't even show up in the logs if you disable password auth in the server config, as you typically should.

[–] FrederikNJS@lemm.ee 0 points 1 year ago (1 children)

As others have already said, set up a VPN like wireguard, connect to the VPN and then SSH to the server. No need to open ports for SSH.

I do have port 22 open on my network, but it's forwarded to an SSH tarpit: https://github.com/skeeto/endlessh

[–] filister@lemmy.world 0 points 1 year ago (1 children)

But Tailscale is Wireguard under the hood.

[–] Holzkohlen@feddit.de 0 points 1 year ago

Yeah, but worse cause it's company owned and not really open source. Why do people use tailscale? Are you so desperate to pay money for it?

[–] yoz@aussie.zone 0 points 1 year ago (1 children)

I am not in IT, what does this mean ?

[–] elscallr@lemmy.world 1 points 1 year ago

Computers communicate across networks using ports. Port 22 is a commonly used remote administration port called ssh. Bots go around probing computers with an open port 22 hoping to find badly secured or outside misconfigured ssh servers to turn them into bots and crypto miners, etc.

[–] notabot@lemm.ee 0 points 1 year ago (1 children)

You really shouldn't have something kike SSHD open to the world, that's just an unnecessary atrack surface. Instead, run a VPN on the server (or even one for a network if you have several servers on one subnet), connect to that then ssh to your server. The advantage is that a well setup VPN simply won't respond to an invalid connection, and to an attacker, looks just like the firewall dropping the packet. Wireguard is good for this, and easy to configure. OpenVPN is pretty solid too.

[–] douglasg14b@lemmy.world 0 points 1 year ago (1 children)

You say this and are downvoted.

While we are coming off the tail of Def Con where there where a plethora or small talks and live examples of taking advantage and abusing just this.

[–] u202307011927@feddit.de 0 points 1 year ago (1 children)

I don't understand your comment, what you are saying. Could you elaborate a bit, please? I'm interested why it's a bad idea what previous comment suggested.

Of course I can dig into DefCon videos and probably would do if needed, but perhaps you know what exactly the issue is

[–] MaggiWuerze@feddit.de 0 points 1 year ago

The first this means the comment he answered to and the second one means ssh being used as an attack surface, being described in defCon talks

[–] Clou42@feddit.de 0 points 1 year ago (4 children)

I’ll take that tiny amount of traffic telling scanners there’s no password auth over having to remember port settings for ssh, scp and rsync any day.

[–] lando55@lemmy.world 1 points 1 year ago

For me it's not about the traffic, more the log spam.

Generally I'll have :22 enabled internally, and anything non-standard is defined in ~/.ssh/config and shared out so I don't have to remember things.

[–] gamer@lemm.ee 1 points 1 year ago

vim ~/.ssh/config

[–] dmrzl@programming.dev 1 points 1 year ago

My configs remember stuff for me.

[–] maiskanzler@feddit.de 0 points 1 year ago

Fair point. These logs are only useless chatter anyway for everyone with proper key auth.

[–] 018118055@sopuli.xyz 0 points 1 year ago (1 children)

I'd favour own VPN instead of relying on an additional third party

[–] entropicdrift@lemmy.sdf.org 0 points 1 year ago (1 children)

Right? PiVPN is easy AF and uses WireGuard. No reason not to set up something yourself if you're already selfhosting.

[–] glasgitarrewelt@feddit.de 0 points 1 year ago (1 children)

Please ELI5: How does this solution work? You tunnel yourself in your home network with a VPN on your PI? How is that safer, isn't there still a port open?

[–] entropicdrift@lemmy.sdf.org 0 points 1 year ago (1 children)

I have a port open, yes, but it's not port 22. The problem with Tailscale is you're trusting a third party. With my setup, it's just me connecting directly to my Pi. Thanks to port forwarding the only open port pointing to my Pi is the one that I use for WireGuard.

I already have a DDNS and domain name pointing to my house, so there's effectively no added risk compared to my existing setup with a couple webapps being reverse proxied behind Caddy on a different device.

[–] glasgitarrewelt@feddit.de 0 points 1 year ago (1 children)

Thanks! I think I get too hung up on the VPN-part. If I had a setup where I open one Port to a Pi which is set up as a nginx reverse proxy that redirects the connection to my different services depending on the URL - homeassistant.myserver.com, backup.myserver.com,... - would that be considered a VPN?

[–] hatedbad@lemmy.sdf.org 0 points 1 year ago (1 children)

no, and that’s be a pretty bad idea, you’re opening up all your internal hosts to the public internet.

a VPN is specifically designed to keep all your internal hosts off the public internet. When you authenticate with the VPN server the remote device you are using effectively “joins” the internal network, using the VPN to act like a tunnel between you and your network.

it has the benefits of better security as well as the fact that once you set it up, you can access any services you host, not just HTTP ones.

[–] glasgitarrewelt@feddit.de 0 points 1 year ago

That sounds good, I will read more about setting up a VPN. Thank you!

[–] Krtek@feddit.de 0 points 1 year ago

Now try IPv6 only :P

[–] 30p87@feddit.de 0 points 1 year ago

I have port 22 open on my PI, every connection failing for some reason after one try, let it be trying to use a password, wrong user or even root, is instantly reported to abuseipdb and rerouted to endlessh