1

I have a server in Oracle Cloud Infrastructure Ashburn. I am using Tailscale to SSH my servers and closed Port 22 in public.

I closed Port 22 on the VCN and left Port 22 open on the server. But no one will access it 'cause I am the only one that can access it via Tailscale.

ubuntu@instance-20220422-2359:~$ sudo firewall-cmd --list-all
public
  target: default
  icmp-block-inversion: no
  interfaces:
  sources:
  services: dhcpv6-client ssh
  ports: 80/tcp 443/tcp
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:
        rule family="ipv4" source address="36.110.228.254" reject
        rule family="ipv4" source address="114.241.52.59" reject
ubuntu@instance-20220422-2359:~$

Today, I received a report from CrowdSec that my server was experiencing ssh-brute force from China IP addresses.

enter image description here

How did it happen? I am using a VPN to access those servers and yet they manage to brute force a closed Port?

1
  • You can render those down to a trivial threat using something like fail2ban. I also strongly recommend disabling root access (use a real account and sudo). Ideally, also restrict logins to using keys.
    – Adam Katz
    Apr 25 at 17:46

1 Answer 1

3

I don't think your configuration is working as you think it should. It is always strongly advised to test your setup from a non-whitelisted IP address.

Your output says:

services: dhcpv6-client ssh

That implies SSH service is effectively exposed, and port 22/TCP is allowed on the public zone, that is for everyone. This is in addition to your port rules or rich rules. But you don't want that.

My suggestion is to remove the SSH service from the public zone, and instead you can add a few whitelisted IP addresses (your VPN) to the trusted zone. This will make the SSH service available but also other running services if present.

Reference: Open a Port or Service

1
  • 1
    Excellent answer, +1. OP, you might want to use a tool like portchecker.co to test if port 22 is really closed to a non-whitelisted IP.
    – mti2935
    Apr 24 at 20:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.