-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

That works too. I was trying to convey a sense of immediate personal responsibility by using the term "your users", but it could be misunderstood.

By the way, what's the policy for having discussions that span multiple mailing list subjects (tor-relays and tor-dev, in this case)? I'm not sure how to best do this without spamming people or fragmenting conversations.

On 11/24/2014 06:22 PM, I wrote:

"..to Tor users and the Tor system"?

_______________________________________________ tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

cron-apt is also a viable option for debians.

https://wiki.archlinux.org/ is afaik the best standard repository of all knowledge and wisdom about current linux, always solved my debian-*codename* problems.

On 25 November 2014 at 05:29, Tor Operator tor@ssessess.es wrote:

On Mon, Nov 24, 2014 at 06:09:34PM -0500, Libertas wrote:

...

Be sure to stay up-to-date using apt-get, and consider using cron-apt to automatically update: https://www.debian.org/doc/manuals/debian-faq/ch-uptodate.en.html

Maybe it also worth covering unattended-upgrades package to keep Debian up to date. It requires to run "dpkg-reconfigure unattended-upgrades" after install as it doesn't enable automatic upgrades right away after install and supposedly don't do potentially dangerous operations like kernel upgrades automatically. Using it in production myself, really helps to keep OS up to date.

Also for protecting SSH SSHGuard is in my opinion a much better choice as it supports IPv6 unlike fail2ban (I heard there were patches for fail2ban to address that but I'm not sure if they are already in mainstream and available in all distributions).

-- Random

---

tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

Hi,

On Tue, Nov 25, 2014 at 10:58:57AM -0500, Libertas wrote:

And I agree about SSHGuard. I've had a better experience with it, and it generally seems like a more carefully developed and more thoroughly documented project. Strangely, though, most experienced sysadmins still use and suggest fail2ban. Maybe I'm just missing something, or maybe people don't know about SSHGuard.

I'm still wondering about the popularity of fail2ban and SSHGuard, specially in regard to the ssh service. You can achieve almost the some behaviour with every major firewall. See for example [1] and [2].

And for the lazy ones, my current configs:

iptables & ip6tables under linux:

# ssh incoming # bucket: /proc/net/xt_recent/SSH - see for stats # ipv4 iptables -N SSHSCAN iptables -F SSHSCAN

iptables -A INPUT -p tcp -m tcp --dport <YOUR-SSH-PORT> -m state --state NEW -j SSHSCAN iptables -A SSHSCAN -m recent --set --name SSH --rsource iptables -A SSHSCAN -m recent --update --seconds 900 --hitcount 5 --name SSH --rsource -j ULOG --ulog-prefix "SSH-Bruteforce iptables: " iptables -A SSHSCAN -m recent --update --seconds 900 --hitcount 5 --name SSH --rsource -j DROP iptables -A SSHSCAN -p tcp --dport <YOUR-SSH-PORT> -j ACCEPT # ipv6 ip6tables -N SSHSCAN ip6tables -F SSHSCAN

ip6tables -A INPUT -p tcp -m tcp --dport <YOUR-SSH-PORT>8080 -m state --state NEW -j SSHSCAN ip6tables -A SSHSCAN -m recent --set --name SSH --rsource ip6tables -A SSHSCAN -m recent --update --seconds 900 --hitcount 5 --name SSH --rsource -j LOG --log-prefix "SSH-Bruteforce iptables: " ip6tables -A SSHSCAN -m recent --update --seconds 900 --hitcount 5 --name SSH --rsource -j DROP ip6tables -A SSHSCAN -p tcp --dport <YOUR-SSH-PORT> -j ACCEPT

pf under FreeBSD:

block quick from <blacklist> # . # . # . pass in proto tcp from any to <YOUR-IP> port = <YOUR-SSH-Port flags S/SA keep state \ (max-src-conn 4, max-src-conn-rate 4/10, overload <blacklist> flush global) label "ssh: in "

You can adjust the parameters to control when a host is blacklisted and for how long.

Stop

Sent from my iPhone

On Nov 27, 2014, at 8:42 PM, Libertas libertas@mykolab.com wrote:

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

...

On 11/27/2014 07:50 PM, tor@zengers.de wrote: And I agree about SSHGuard. I've had a better experience with it, and it generally seems like a more carefully developed and more thoroughly documented project. Strangely, though, most experienced sysadmins still use and suggest fail2ban. Maybe I'm just missing something, or maybe people don't know about SSHGuard.

I'm still wondering about the popularity of fail2ban and SSHGuard, specially in regard to the ssh service. You can achieve almost the some behaviour with every major firewall. See for example [1] and [2].

And for the lazy ones, my current configs: ...

True, and thanks for the examples. I think the daemons are probably a better move for those who aren't firewall veterans, as everyone else would probably be copy-and-pasting firewall configs like the ones you gave and praying that they worked. The daemons probably also have more nuanced and flexible policies.

You also reminded me of a big factor I forgot to mention in the doc: firewalls. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1

iQIcBAEBCAAGBQJUd9MUAAoJELxHvGCsI27NlY0P/0MeYML3CCLlF3JHRDVy85CE FjjQlUjIH3wnTGuQJE/ooubWH8KslLhSq2PjBXMgxuObshf9DEHWHy7KNYvAJ+GE 1VMjONDV6uuZILLPur1UxFlSPrB2LfzBJCqLfx/LmtQFPoH3AztJnkyqLZIkVcMs X8IJ4Dv2kvX3q9oIXdqyiTECLSsAZ5GyhOcNPZGLdijaijWL6ajrpq74NE89cjNu TX4d5eR2WSJm18lQ3ViOwh4DmdRA/HeqtH/M3/DsDJvOP4D5lrERrc6ghBShZdsl dKndLPLWFTGGdV4DAbn96FBZQW9q2feRb+DBSdOXPlc8KqOFF2BMrb2a4tWv/szs uiTqsYTDj7TkvOLIR3Y1V1uRm6WvxdU5FKNH7+qouQg8G4hLPrcxmIGOTELDZtzn s30ffOScgM7kn3qb8hbs50peMDb3A67GXgNFnvFSf1eAaWJQdDbzYEfxzBzGvtvb DYCeavXAKC8LsgRIcfjnuhPuTfP0PSKX0RABgPR0hkt3TGsCObMSUETHD1IqRv+1 wWjLf+52Kn9ZwPxPxUt8yngaOZr9iGAKlQJJwoacujAFCjoGR+SflEojFjBcdyVV mZqgyDgSeAhPZyMIY5shY5VJcT7wBbUy8oLSEjdfOxrfUe4dHLPfGvPmv7U2sJQX rVwbNoRfYr2mhgLap7dN =UtrW -----END PGP SIGNATURE----- _______________________________________________ tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

On Mon, Nov 24, 2014 at 11:29 PM, Tor Operator tor@ssessess.es wrote:

On Mon, Nov 24, 2014 at 06:09:34PM -0500, Libertas wrote:

...

Be sure to stay up-to-date using apt-get, and consider using cron-apt to automatically update: https://www.debian.org/doc/manuals/debian-faq/ch-uptodate.en.html

Maybe it also worth covering unattended-upgrades package to keep Debian up to date. It requires to run "dpkg-reconfigure unattended-upgrades" after install as it doesn't enable automatic upgrades right away after install and supposedly don't do potentially dangerous operations like kernel upgrades automatically. Using it in production myself, really helps to keep OS up to date.

Agreed, but note that unattended-upgrades does not restart services whose libraries have been upgraded underneath them -- that's rather important for making sure that an OpenSSL patch, for instance, actually gets loaded into the running Tor and SSH daemons. You need 'needrestart' as well (and it, too, has to be configured to do stuff automatically).

zw

Hi,

On Tue, Nov 25, 2014 at 08:58:04PM +0100, tor-admin@torland.me wrote:

Don't store identity keys on the hard disk. Keep them offliner. Use a ramdisk for /var/lib/tor/keys/ and copy keys to it via scp before starting your tor instance. Remove it from the ramdisk after startup. So the keys cannot be easily taken during unexpected downtimes.

that's a nice idea. But keep in mind that your ramdisk could be offloaded to swap. So make sure your swap is encryted too. Also your keys could still be stolen while the server is running.