New answers tagged

17

I ignore them. And if you have a reasonable security posture, you should too. Your servers should have no ports open to the general public other than those that you use to serve the general public. For example, your web server should have open port 80, 443, and maybe 22; everything else should be SSH-tunneled or otherwise VPN'ed if you need to connect to ...


1

After I see someone scanning I usually do a little recon on who they are, if they are on known blocklists I usually ignore and let the firewall drop it (ASAs). If they are an unknown entity I'll add a rule to drop connections with our IPS from that IP. I have used suricata in the past and will give that a +1 as it could help in a situation like this as the ...


6

I don't believe in enumerating badness. If you have infrastructure sitting on the internet it's going to get scanned all the time by numerous IPs. For example, I created an AWS app that turns up spot instances, scans blocks of IPs from a list, and turns them off once the results are shipped to the master server. If I was scanning your range daily you ...


3

I use Snort or Suricata on pfSense to automatically block IPs for a time period. Sophos UTM appears to have similar functionality.


0

Consider Joe the Script Kiddie. Joe starts his ssh scanner script. This takes an IP address range, and goes on exploring all devices on that range, checking if port 22 is open. If it is, it assumes it's an ssh server, and can start trying to find usernames and passwords. If your sshd is on a different port, you'll only be susceptible to scanners which do ...


0

I think there is problem with your comparison: while it is possible that every user on the system adds some chosen number to the password it is not possible that every user gets its own chosen SSH port. Therefore a different port can never be a replacement for a better password (and of course you should choose keys anyway). Instead a different port is a ...


1

If there's a rogue process running on your Raspberry Pi then you have already been compromised, although the attacker or automated malicious process obviously hasn't managed to elevate to root yet. The rogue process cannot access the host keys, so would present a different fingerprint to the user when connecting, alerting them to an issue. That is ...


3

Services running on ports < 1024 (at least on *nix servers) are generally considered to be more secure, because they require root (or a trusted user that has root privileges) to start them - whereas services running on ports >= 1024 could be run by an untrusted (possibly rogue) user on the server. So, it is plausible that an attack like the one described ...


0

Some SE threads are discussing the pros & cons of this from a security perspective. Does changing default port number actually increase security? and Should I change the SSH port to < 1024?. However, there is also a risk involved, that the rogue process you mentioned actually locks you out of your server. The chances that this happens may be low, ...


0

TCP 7547 is used for CPE WAN Management Protocol (CWMP) any may only be exposed to your internal interface (run a scan on your public IP from outside your network to see if this service is exposed to remote actors). This management protocol can sometimes be disabled in the management GUI, other times it's possible only at the command line (Telnet or SSH if ...



Top 50 recent answers are included