Another good reason not to open port 22 - eviltoast

In the past two weeks I set up a new VPS, and I run a small experiment. I share the results for those who are curious.

Consider that this is a backup server only, meaning that there is no outgoing traffic unless a backup is actually to be recovered, or as we will see, because of sshd.

I initially left the standard “port 22 open to the world” for 4-5 days, I then moved sshd to a different port (still open to the whole world), and finally I closed everything and turned on tailscale. You find a visualization of the resulting egress traffic in the image. Different colors are different areas of the world. Ignore the orange spikes which were my own ssh connections to set up stuff.

Main points:

  • there were about 10 Mb of egress per day due just to sshd answering to scanners. Not to mention the cluttering of access logs.

  • moving to a non standard port is reasonably sufficient to avoid traffic and log cluttering even without IP restrictions

  • Tailscale causes a bit of traffic, negligible of course, but continuous.

  • u_tamtam@programming.dev
    link
    fedilink
    English
    arrow-up
    55
    arrow-down
    2
    ·
    1 year ago

    Or, you know, just use key auth only and fail2ban. Putting sshd behind another port only buys you a little time.

    • nomadjoanne@lemmy.world
      link
      fedilink
      English
      arrow-up
      22
      ·
      1 year ago

      Yeah but the majority of bots out there are going after easy prey. Honestly, if you use public key authentication with ssh you should be fine, even if it is on port 22. But it does of course clog up access logs.

      • marcos@lemmy.world
        link
        fedilink
        English
        arrow-up
        16
        ·
        1 year ago

        The majority of bots out there are stopped by just using a hard to guess password. It’s not them that you should be worried about.

        • aard@kyu.de
          link
          fedilink
          English
          arrow-up
          10
          ·
          1 year ago

          The majority of bots doesn’t even show up in the logs if you disable password auth in the server config, as you typically should.

    • MangoPenguin@lemmy.blahaj.zone
      link
      fedilink
      English
      arrow-up
      2
      ·
      1 year ago

      I’ve noticed that a lot of the scans these days almost always switch IPs after 2-3 attempts, making IP blocking a lot more difficult.

      • u_tamtam@programming.dev
        link
        fedilink
        English
        arrow-up
        1
        ·
        1 year ago

        Let’s say that you could ban for an indefinitely large amount of time after a single failure to authenticate, that’d make them run out of IPs much quicker than you’d run out of CPU/BW, so I don’t really see the issue

          • u_tamtam@programming.dev
            link
            fedilink
            English
            arrow-up
            2
            ·
            1 year ago

            True, but very unlikely (once your ssh client is configured once and for all), and in that event you can always switch connection (use a data network, proxy, vpn, hop from another server you have ssh access, etc)