sshd attack traffic

• April 8, 2020

I firmly believe that security through obscurity is a fail. However, I do believe that all things being equal, making it a bit more obscure is better as long as you aren’t introducing more failure points, like a port knocker that has it’s own security bugs. Thus I’ve always run my sshd service on an alternative port. It’s simple, and keeps my logs clean and shouldn’t cause any additional security risks. Of course I use a secure configuration and keep my software up to date. However, I found out that in the past few weeks that my port of choice has been discovered.

After the sad realization that I would need to pick a more random port I decided to look at the attempts to brute force my sshd service and summarize what I found.

Some basic numbers

• 161928 total attempts over the past 30 days
  • 5398/day, 225/hour, 3.75/sec
• 21380 unique user names

Most common user name used in login

User names that look like passwords

Seriously, if you’re going to go through the hassle of trying to break in to peoples computers, at least you could do is debug your scripts to ensure you are sending the user name and password correctly. These are not user names, they are passwords and parts of passwords that have been published on on the internet. These all happen to be from the same IP address which is from the University of Dhaka, Bangladesh. Stay in school people, use your skills for good, not evil!

Top 10 attack hosts IP address and count

It only took 20 years for people to find my port number of choice. I don’t think I’ll have nearly that much time before they find the next one. In the mean time I’m going to run a honeypot on port 22 and automatically collect the username, password, IP address etc. and generate automatic results. Maybe something like this. That should keep them distracted from looking for other ports, and maybe I’ll make it into a tarpit, to slow them down too :-).