Comment on Alternative to ClamAV?
peter@feddit.uk 1 year agoGlad you asked, I run a ssh honeypot and get multiple connections adding ssh keys, trying to run lockr, downloading shit every day.
2023-09-16T09:09:48+0000 [SSHChannel session (1) on SSHService b’ssh-connection’ on HoneyPotSSHTransport,14737,61.222.241.108] Command found: echo ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr >> .ssh/authorized_keys
Running a honey pot for SSH and sharing logs only proves that people try to attack you, it does not really tell if SSH as such is vulnerable or not. It is a honey pot, people gaining access if the whole point.
Having a locked down but exposed SSH access is something else.
You’re missing my point, a virus doesn’t have to infiltrate a completely secure system. It can come through you accidentally leaving your ssh insecure or any other service.
I get that a malware can get inside the worlds most secure system, if for example a user lets it in. What I am saying is that showing a honey pot in response to “ssh is more secure than a software that runs code without you giving consent and without your knowledge” not say anything, except what happens if someone gets in.
Zeth0s@lemmy.world 1 year ago
Does the attack succeed? Never happened to me. You see bot trying, but really never seen succeeding irl. How is it configured?
XTL@sopuli.xyz 1 year ago
Also, antivirus is the wrong idea there. What you’d want is an intrusion detection and/or integrity checking system.
Zeth0s@lemmy.world 1 year ago
And disable password authentication as first step
peter@feddit.uk 1 year ago
It’s configured to allow requests from connections using common default passwords. If it wasn’t a honeypot the requests would succeed. I don’t currently run an rdp honeypot but I did a few years back, iirc the rates were about the same with rdp being a little bit less. Which as I say, comes down to configuration and usage. If you misconfigure Linux you will get malware, same as Windows.
Zeth0s@lemmy.world 1 year ago
Ok, than the experiment you are doing is to check how many attacks you can get over time… It is not really representative of a common use case. And again, this is not a virus. It is an successful attack from on a purposely misconfigured internet service. An antivirus is not needed. What is needed is basic configuration
peter@feddit.uk 1 year ago
Okay if we are taking the definition of a virus to be something that a person must download and execute, what about malicious javascript/python packages? They often target production systems running Linux and infection is caused by user error rather than misconfiguration.