The only time I ever exposed my SSH port to the WAN, I got about 750 connection attempts from China and 250 attemps from Russia per hour.
Fail2ban with increasing jail time for repeat offenders usually takes care of the worst of it after a day or two
Did it help you find hot milfs within a mile of your location?
99.999% of that is over IPv4. I leave IPv6 open to WAN for my own use and it’s not a problem.
Thanks for the intel
yeah, while reading this i was going “What maniac exposes SSH to WAN anyway…?” the whole time. I fail to see any reason or point that can be justified exposing SSH to WAN.
Any VPS provider just gives you an SSH IP and port. So that’s the default state, until you do something else, which I imagine many don’t, since key based authentication was always considered secure.
So I don’t know the reason, but that’s the standard practice with most providers, like Digital Ocean or Linode or whatever. You can call them maniacs but you shouldn’t be surprised at something so ubiquitous.
New friends from all over the world!
How do you know this? What tool or utility tells you this fact? I have a port exposed for a game server but realising I don’t know how many attempts are being made.
I was kinda new to linux so I used https://www.papertrail.com/ and hooked it up to my syslogs, and then went “oh… oh no… oh god no…” and immediately turned off SSH.
Thank you kindly, I am reasonably new to Linux myself. Ibuse it but don’t have a great understanding
Ibusing it is how you learn it.
One reason that I have my router ignore all connection attempts from Russia and China
Russia, China, India, NK should be on all block lists
What if they use VPNs? THEN WHAT?!
Among other things, change the default ssh port to something way higher.
Is the name of the vulnerability literally *sshole?
Yes, it’s actually a very creative name. It’s caused by the character * allowing anyone to log into an open SSH port. So it’s an amalgam of {*}{SSH}{port (hole)}.
The long story short is that if you don’t have a password set for an account, Alpine saves the user’s password hash as “*” because no password hash will ever match it. Should be safe, right? Any password will always automatically fail, because the hash algorithm cannot return “*” as a result. So the only way to log in as that user is via something besides a password.
And when musl (the underlying system that Alpine uses for SSH) gets a Null response from its password hash, it uses “*” to represent that null value. Because lots of programs throw a fit if they get a true null value. So instead of returning a null value, it just returns a *. Which shouldn’t match anything, right?
So an attacker forces the password hash to return a null value. Simple to do, because the password hash is capped at 256 characters. So just enter something with more than 256 characters. Musl takes that null value, turns it into a *, and passes that onto Alpine. Alpine takes this *, and compares it with the list of saved usernames and password hashes. And it finds that the user (who has no password set, and shouldn’t be allowed to log in with a password) has a password hash of “*”. This matches the result musl just provided, so the attacker is able to log into the system.
Ok, I’ve never shared my nudes but that was such a good explanation that I’m considering it…
Okay, I don’t understand too much, but holy shit this is so cool. Thank you very much for the explaination! <3
Thanks a lot for this.
Cyberpunk as fuck.
Fuck. OpenWRT might fit that bill.
Edit: it does, kind of:
https://forum.gl-inet.com/t/sshole-exploit-does-not-impact-gl-oem-firmware/72657
Most ssh ports should be accessed through a VPN anyway, not exposed directly to the internet
What an aSSHole!
Well that sucks. IIRC a lot of my docker images are alpine based, but they’d be safe due to never having their SSH ports exposed I assume.
Wait that means I have to expose a port. But I have zero exposed ports.
This post was created by the pangolin-gang.
I’ll expose my port to you.
Privileged port?
deleted by creator
