How (in)secure is this? reddit / selfhosted ---------------------------------------------------------------------- Mensch88 · 2023-12-31 00:24 I have two vps, the first with a 6 character root password (a-z,0-9,A-Z) and another one with a 32 character root password, both on port 22 without bruteforce protection, how long will it take before *something* happens? ---------------------------------------------------------------------- WestParfait6451 · 2023-12-31 00:25 Oh man, you're playing with fire there my friend. A 6 character root password without any anti-bruteforce measures could potentially be cracked in mere seconds depending on the specifics of your VPS provider and how they handle login attempts. Now your 32 character password, that's definitely more robust, but you're still leaving yourself open to risk without any protection from bruteforce attacks. I would really recommend you look into securing your vps a bit more, maybe start with implementing Fail2ban or something similar at least. It's a dangerous world out there man, don't leave your digital door wide open! ---------------------------------------------------------------------- Mensch88 · 2023-12-31 00:30 wow, is it actually that Dangerous? i though besides port scans and common passwords nothing much would Happen because of how resource intensive bruteforcing is, its been like this since a week now... ---------------------------------------------------------------------- Other-Technician-718 · 2023-12-31 00:31 I guess a brute force is already ongoing - if not, it will start as soon as a bot finds your port 22. ---------------------------------------------------------------------- Mensch88 · 2023-12-31 00:33 have it a week already like this, doesnt look like something bad is gonna happen ---------------------------------------------------------------------- National-Dust-2194 · 2023-12-31 00:42 I like to drink and drive. Been doing it for a week and doesn't seem like anything bad will happen. Sounds stupid, right? ---------------------------------------------------------------------- Mensch88 · 2023-12-31 00:43 lmaoo :) ---------------------------------------------------------------------- lesigh · 2023-12-31 00:45 Why play with fire? Disable passwords, use ssh keys and install fail2ban ---------------------------------------------------------------------- Admirable_Can_5046 · 2023-12-31 00:48 Having random bots doing scans and some basic brute forcing on your IP might be alright, but there's also a chance that someone more skilled could take an interest in your server. It all comes down to how much you value what you've got stored on your server. If you don't really care, that's your call. Just something to think about. ---------------------------------------------------------------------- StillAffectionate991 · 2023-12-31 00:49 At least use ssh keys and disable passwords. ---------------------------------------------------------------------- StillAffectionate991 · 2023-12-31 00:49 At least use ssh keys and disable passwords. ---------------------------------------------------------------------- clintkev251 · 2023-12-31 00:49 If you're going to have SSH publicly exposed, you need to use key based authentication and disable passwords. It is not safe in it's current state ---------------------------------------------------------------------- KlausBertKlausewitz · 2023-12-31 00:55 at least install fail2ban .. ---------------------------------------------------------------------- renegadson · 2023-12-31 00:55 Even with 32 char pw its a timebomb. Close your FW ports and setup VPN fore remote access, it's not that hard, put there 32 char PSK, 32 char userpass and fail2ban on top ---------------------------------------------------------------------- someguynamedlou · 2023-12-31 00:56 Just for fun: https://en.wikipedia.org/wiki/Port\_knocking ---------------------------------------------------------------------- everfixsolaris · 2023-12-31 01:02 I find port 22 login attempts are pretty common on the open internet, for VPS I usually firewall port 22 using the cloud firewall and use a VPN to access SSH. Unless something breaks on the VPN then I open the port for my IP until the problem is fixed. A funny aside on this topic: A friend of mine uses fail2ban to cut down on the random scanning by blocking by IP and ended up locking out the management IPs from the VPS provider. The provider based monitoring kept triggering his firewall rules and fail2ban closed all possible ingresses. ---------------------------------------------------------------------- Silejonu · 2023-12-31 01:27 No need for skill to pown an SSH server with root login permitted, a 6-character password, no fail2ban and port 22 open to the Internet. It's just a matter of time. ---------------------------------------------------------------------- Silejonu · 2023-12-31 01:31 With that level of "security", either it's already someone else's VPS now, or it will soon be. ---------------------------------------------------------------------- Other-Technician-718 · 2023-12-31 01:41 To spice things up you can post your ip / domain here - but don't complain afterwards when strange things happen. ---------------------------------------------------------------------- ro55mo · 2023-12-31 01:51 Password crack time based on length. [https://imgur.com/a/TEO4hpj](https://imgur.com/a/TEO4hpj) 3 minutes to break the first one approximately. ---------------------------------------------------------------------- Romi3 · 2023-12-31 01:54 No it isn't. SSH is extremely slow to brute force. Even if you had millions of devices performing a brute force attack in parallel, you're not going to be able to brute force a 13 character or higher randomly generated password. Even if you can guess trillions of passwords a second you won't be able to do it in our lifetime. ---------------------------------------------------------------------- primalbluewolf · 2023-12-31 01:54 > because of how resource intensive bruteforcing is It's practically free. ---------------------------------------------------------------------- primalbluewolf · 2023-12-31 01:56 > ended up locking out the management IPs from the VPS provider Lol... at that point, wouldn't they just terminate that instance? ---------------------------------------------------------------------- Mensch88 · 2023-12-31 02:02 gimme a sec, lemme copy it real quick ---------------------------------------------------------------------- Mensch88 · 2023-12-31 02:03 no wayyy, someone has to send millions of requests, that takes a lot of resources ---------------------------------------------------------------------- primalbluewolf · 2023-12-31 02:06 It's what they're built for. It doesn't even take a decent computer to do it. Just a cheap internet connection, and electricity. ---------------------------------------------------------------------- Outrageous_Plant_526 · 2023-12-31 02:06 If they have the hash. Otherwise there are millions of possibilities to try. ---------------------------------------------------------------------- root_switch · 2023-12-31 02:18 This has nothing to do with self hosted. Should post in r/hacking ---------------------------------------------------------------------- Mensch88 · 2023-12-31 02:19 ssh server: am i a joke to you ---------------------------------------------------------------------- root_switch · 2023-12-31 02:22 If you wana have more fun set up a honeypot on your VPS and watch the shit show of robot scripts download all kinds of shit. ---------------------------------------------------------------------- Mensch88 · 2023-12-31 02:24 you mean giving them access??? wouldnt do that because then im the asshole who is responsible for billions spent on anti-ddos Equipment ---------------------------------------------------------------------- Scoth42 · 2023-12-31 02:37 If you're going to have SSH on port 22 at all, and you want to have passwords enabled, disable root logins. There's zero reason to have root logins enabled over ssh. Add a normal user (with a good password) and give it sudo/su access. Preferably setup in a way that uses a different password for escalation purposes. Key auth and/or VPNs are the better way to go, and a non-standard port is helpful too. ---------------------------------------------------------------------- guiand888 · 2023-12-31 02:37 A 32 characters root password is more than reasonably strong. However, key based auth is always advised when SSH is publicly exposed. There are a bunch of reasons to this: - You can safely reuse keys so it's easy to manage. - SSH keys can't be intercepted since your private key is not sent over the network. - You won't be vulnerable to dictionary attacks, which is a real threat with a 6 characters password. ---------------------------------------------------------------------- root_switch · 2023-12-31 02:37 Nah a honeypot. There is honeypot software, it essentially emulates a server with limitations but also records everything. Essentially allows you to watch attack patterns and behaviors. ---------------------------------------------------------------------- benjaminchodroff · 2023-12-31 02:56 No clue, but highly recommend against this. Perhaps a better option is to use something like Tailscale (with tailnet lock if you want extra protection) and avoid exposing these type of services directly to the internet? ---------------------------------------------------------------------- emprahsFury · 2023-12-31 03:05 Single 4090 can do 1179.6 kH/s for SHA512 (the default ubuntu shadow hash) OP has a 6 character alphanumeric password. * 26 + 26 + 10 = 62 characters * Keyspace = 62^6 = 56,800,235,584 * 1179.6 kH/s * 1000 = 1,179,600 passwords guesses per second * Time to crack = 56,800,235,584 possible passwords / 1,179,600 passwords per second * Time to crack ≈ 48,154 seconds * 48,154 seconds / (24 hours/day * 60 minutes/hour * 60 seconds/minute) ≈ 0.56 days You can literally just slide this compute in between your weeb stablediffusion prompts and not notice a thing ---------------------------------------------------------------------- heydroid · 2023-12-31 03:06 6 letter password is basically a mater lock to the lock picking lawyer, Disable passwords, and the root account, Use a different account with keys. Changing SSH to not 22 will clean up your logs, but not add any real security. ---------------------------------------------------------------------- Outrageous_Plant_526 · 2023-12-31 03:08 Yeah, if they have the hash. You can't do that over the internet trying to brute force a password login. Plus you need the username as well as most systems don't allow login via root. ---------------------------------------------------------------------- emprahsFury · 2023-12-31 03:19 When was the last time you put the Windows key into a password prompt. or sent the shift key into a hashing function. I was with you until you started the nonsense. A 32 character password of just the ten digits is still something like 2.88 × 10^22 years. You don't have to make shit up to prove this point. ---------------------------------------------------------------------- emprahsFury · 2023-12-31 03:22 When the Most Interesting Man in the World does this he gives his low priv user ALL ALL=(ALL) ALL rights in /etc/sudoers ---------------------------------------------------------------------- emprahsFury · 2023-12-31 03:25 You do not need the hash to calculate new hashes. This isn't some sort of table lookup. You can calculate every single possible hash in the OPs password in less than a day. ---------------------------------------------------------------------- ianjs · 2023-12-31 03:32 How is a user with Sudo access not a root login with one tiny step extra? Surely it's only as secure as the user password then? As you said, key access eliminates most of these issues and has the bonus of never having to type a password again. ---------------------------------------------------------------------- Scoth42 · 2023-12-31 03:38 That's what I meant by the next line about preferably with a different password. You can have sudo require the root password instead of the user's (requiring two cracked passwords) among other options. And, although it's older fashioned, some distros still use su by itself for escalation which typically uses the root password and could be set up on other distros. If someone really wants ssh with password auth, that'd be the better way to do it. ---------------------------------------------------------------------- adamshand · 2023-12-31 03:40 Good experiment! I've had ssh servers with port 22 open to the internet and 8 character passwords for decades and nothing has happened. I do disable root though. :-P ---------------------------------------------------------------------- tjernobyl · 2023-12-31 03:47 Rainbow tables have been a thing for ages. But it's been known since like .. before 1992 that if you leave your password hashes out where anyone can see them, you're already as good as compromised. ---------------------------------------------------------------------- identicalBadger · 2023-12-31 04:35 Why isn’t Ubuntu using something more resistant to brute forces like Bcrypt? ---------------------------------------------------------------------- everfixsolaris · 2023-12-31 06:13 They had a fun time troubleshooting the issue, terminated the VPS and gave him some credit as compensation and told him to disable monitoring in the panel before he tried that again. For a more technical user, virtual serial, and mounting the boot block device on a different VM are at least two ways off the top of my head I can think of receiving from this mistake. ---------------------------------------------------------------------- PkHolm · 2023-12-31 06:44 no need, just be sure that root login is disabled. ssh is allowed to login only for one single username and that username is not obvious. ---------------------------------------------------------------------- AleBaba · 2023-12-31 07:15 That's a common misconception. It's true a 6 character password can be guessed very fast on hardware, but there are limiting factors to the guesses that can be made, namely network connection and hashing algorithm. Even if you theoretically assume there's 0 delay in network communication with the server there will still be a delay in software (on purpose). So even if you had two attempts at guessing the password per second it would take realistically years to guess a random 6 character password to access an SSH server. ---------------------------------------------------------------------- ganziale · 2023-12-31 09:02 if you do that chances are that you will need to give the user sudo anyways, the safe way is to use ssh keys and disable passwords ---------------------------------------------------------------------- KervyN · 2023-12-31 09:56 6 char PW tales around 5 minutes to brute force. ---------------------------------------------------------------------- Admirable_Can_5046 · 2023-12-31 10:04 100% agree, modified the wording... I think OP got the point though... it's a ticking bomb ---------------------------------------------------------------------- amarao_san · 2023-12-31 13:27 If passwords are random-generated, you are safe. No one is really brute force random passwords, all bots are doing dictionary attacks. If you want more security, use ssh keys of ECDSA type. ---------------------------------------------------------------------- PkHolm · 2023-12-31 21:53 what it is to do with sudo? for bruteforce attack you need to guess username and password? Any unix has a root user, so first part is solved. If you disable root username also need to be guessed. SSH key opens another bunch of attack vectors, so it is not perfect too.