Selfhosted @lemmy.world aesir @lemmy.world 1 yr. ago

Another good reason not to open port 22

In the past two weeks I set up a new VPS, and I run a small experiment. I share the results for those who are curious.

Consider that this is a backup server only, meaning that there is no outgoing traffic unless a backup is actually to be recovered, or as we will see, because of sshd.

I initially left the standard "port 22 open to the world" for 4-5 days, I then moved sshd to a different port (still open to the whole world), and finally I closed everything and turned on tailscale. You find a visualization of the resulting egress traffic in the image. Different colors are different areas of the world. Ignore the orange spikes which were my own ssh connections to set up stuff.

Main points:

there were about 10 Mb of egress per day due just to sshd answering to scanners. Not to mention the cluttering of access logs.
moving to a non standard port is reasonably sufficient to avoid traffic and log cluttering even without IP restrictions
Tailscale causes a bit of traffic, negligible of course, but continuous.

119

119 comments

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

Fewer Letters	More Letters
DNS	Domain Name Service/System
HTTP	Hypertext Transfer Protocol, the Web
IP	Internet Protocol
SSH	Secure Shell for remote terminal access
UDP	User Datagram Protocol, for real-time communications
VPN	Virtual Private Network
VPS	Virtual Private Server (opposed to shared hosting)
nginx	Popular HTTP server

7 acronyms in this thread; the most compressed thread commented on today has 8 acronyms.

[Thread #42 for this sub, first seen 14th Aug 2023, 15:55] [FAQ] [Full list] [Contact] [Source code]

Public key auth, and fail2ban on an extremely strict mode with scaling bantime works well enough for me to leave 22 open.

Fail2ban will ban people for even checking if the port is open.
You really shouldn't have something kike SSHD open to the world, that's just an unnecessary atrack surface. Instead, run a VPN on the server (or even one for a network if you have several servers on one subnet), connect to that then ssh to your server. The advantage is that a well setup VPN simply won't respond to an invalid connection, and to an attacker, looks just like the firewall dropping the packet. Wireguard is good for this, and easy to configure. OpenVPN is pretty solid too.
Or, you know, just use key auth only and fail2ban. Putting sshd behind another port only buys you a little time.
I’ll take that tiny amount of traffic telling scanners there’s no password auth over having to remember port settings for ssh, scp and rsync any day.
I opened a raw text channel on the Telnet port for a personal game engine project and someone tried to enable commands and do some shady stuff. Unfortunately for them, that's not a valid chess move.
Just do it properly and configure sshd securely. When you have a machine exposed to the internet, you should expect it to be attacked. If you really want to give the finger to bots, run endlessh on port 22 and keep sshd on a non-standard port. Stay safe.
I get what you say, and you're definitely not wrong to do it. But as I see it, you only saved ~80Kib of ingress and a few lines of logs in the end. From my monitoring I get ~5000 failed auth per day, which account for less than 1Mbps average bandwidth for the day.

It's not like it's consuming my 1Gbps bandwidth or threatening me as I enforce ssh key login. I like to keep things simple, and ssh on port 22 over internet makes it easy to access my boxes from anywhere.
I'd favour own VPN instead of relying on an additional third party
10mb is pretty much nothing. May as well just use Fail2Ban.
If you do want to open 22, and there are plenty of good reasons to want to, just implement something called port knocking and you can do it safely.

Note with this you still need good authentication. That means no passwords, key based auth only.
I am not in IT, what does this mean ?
ITT: People who don't understand Tailscale or are allergic to it for 'reasons'
Now try IPv6 only :P
As others have already said, set up a VPN like wireguard, connect to the VPN and then SSH to the server. No need to open ports for SSH.

I do have port 22 open on my network, but it's forwarded to an SSH tarpit: https://github.com/skeeto/endlessh
I don't get tailscale? In-kernel Wireguard is easy to setup. What does it add to this?
And yet it is more likely that tailscale get owned since the reward is much higher. I take my chances with my secured openssh server at port 22 vs a 3rd party company who controlls the access.
For management ports, I set up a firewall on the VPS to only respond to connections from known IPs.
I don't know if it was mentioned already but how could I check if my ports are under "attack"? OPs graphic looks really nice
The best reason is reducing attack surface. It's such an easy thing to do. I don't know why people still expose services they don't need to.
Throw CrowdSec on there to stop the bots before they can do anything
Prevent password auth and setup sshguard. Wireguard is very nice in that it doesn't support password auth.
Is public key authentication not good enough? Tailscale is cool but can be tedious if you also use other VPNs
Whys this a problem disable password auth and wish em good luck lol.
What software did you use you monitor this? I am newish to self hosting and would like to secure my connection better.
Exploring Go High Level:

What’s the Enthusiasm About?
Hello there! Are you familiar with Go High Level? If not, let's break it down. Imagine managing multiple apps for marketing. Sounds busy. That's where Go High Level comes in. It's like that friend who has a solution for everything. Whether you are working on creating an outstanding sales funnel or sending out an email campaign, this platform has your back. The best part? They let you test drive everything with a 14-day free trial. It's like trying out a new car but for your business. And if you ever need assistance, their support team is just a click away. Pretty exciting, huh?

So, How Much Does It Cost?
Alright, let's talk about the financial side. Go High Level offers 3 main plans. The Agency Starter Plan is perfect if you're just starting or have a small business. It's loaded with all the essential tools, and it's quite cost-effective. But if you're looking to scale up, the Agency Unlimited Plan is your best choice. It's like the VIP pass at a concert, giving you access to everything without any limitations. Not sure about committing? Remember that 14-day free trial I mentioned? It's a great way to give it a try without any obligations. Lastly, they offer a Pro plan that includes "SaaS mode," where you can white label the product under your brand. Fantastic!

Why Everyone's Raving About It:
In a world full of sophisticated digital tools, Go High Level is like that all-in-one Swiss Army knife. There's no need to switch between apps because it has everything under one roof. Whether you're a newcomer or an experienced marketer, it's super user-friendly. It's not just about launching impressive campaigns; they ensure you understand their performance with top-notch analytics. There's even a white-label feature for marketing agencies, so you can add your brand and impress your clients.

Here is a link to their 14-day free trial:
https://www.gohighlevel.com/?fp_ref=get-started-now.
Exploring Go High Level:

What’s the Enthusiasm About?
Hello there! Are you familiar with Go High Level? If not, let's break it down. Imagine managing multiple apps for marketing. Sounds busy. That's where Go High Level comes in. It's like that friend who has a solution for everything. Whether you are working on creating an outstanding sales funnel or sending out an email campaign, this platform has your back. The best part? They let you test drive everything with a 14-day free trial. It's like trying out a new car but for your business. And if you ever need assistance, their support team is just a click away. Pretty exciting, huh?

So, How Much Does It Cost?
Alright, let's talk about the financial side. Go High Level offers 3 main plans. The Agency Starter Plan is perfect if you're just starting or have a small business. It's loaded with all the essential tools, and it's quite cost-effective. But if you're looking to scale up, the Agency Unlimited Plan is your best choice. It's like the VIP pass at a concert, giving you access to everything without any limitations. Not sure about committing? Remember that 14-day free trial I mentioned? It's a great way to give it a try without any obligations. Lastly, they offer a Pro plan that includes "SaaS mode," where you can white label the product under your brand. Fantastic!

Why Everyone's Raving About It:
In a world full of sophisticated digital tools, Go High Level is like that all-in-one Swiss Army knife. There's no need to switch between apps because it has everything under one roof. Whether you're a newcomer or an experienced marketer, it's super user-friendly. It's not just about launching impressive campaigns; they ensure you understand their performance with top-notch analytics. There's even a white-label feature for marketing agencies, so you can add your brand and impress your clients.

Here is a link to their 14-day free trial:
https://www.gohighlevel.com/?fp_ref=get-started-now.

You've viewed 119 comments.