Blocking beyond the web: shutting bad bots out of SSH

We recently introduced a new system that protects your sites by judging bots by their behaviour. The system shuts out any bad bots caught on one server across all our Web Hosting servers. It’s been very effective, but this work only covers bots hitting your sites over the web.

But bots don’t stop trying to access your site just because they’ve been banned from visiting it on a browser. That’s because web servers aren’t only accessed over a browser.

Our Web Hosting is designed to be straightforward and easy to use, so that you don’t have to worry about things like this. And you still don’t. We’re just letting you know that we’ve added more protection against bad bots trying to access your sites in nefarious ways.

If you want to know more about the latest protective measures we’ve taken, keep on reading.

Many ways to access a server

Maintaining sites on our Web Hosting packages requires less technical expertise than managing a Virtual Private Server. When you make changes to your Web Hosting sites, you typically sign into the MyHost Client Area and access sites via cPanel.

But web servers aren’t always accessed that way. Secure Shell (SSH) is another way to access servers, albeit a much more technical method.

SSH works by encrypting and authenticating connections between devices. In other words, it sets up a connection between a user’s computer and the server, skipping right past the MyHost Client Area and cPanel. Encryption scrambles the data during the connection, so that anyone (or anything) trying to intercept the data only finds nonsensical data and your information remains secure.

As web hosts, we see lots of servers with SSH enabled get hit with steady streams of bots—repeatedly trying common usernames and leaked passwords. Most of those bots bounce off, but they never stop knocking on the door and trying to get through.

So, we're taking the same community-immunisation approach that we used with blocking bad bot web traffic, and applying it to SSH ports on our Web Hosting servers.

Same idea, new door

For the past couple of weeks, we've been collecting SSH logs from traffic across our entire network to build an expanded blocklist. Every time we identify a bad bot, it gets on the list. There are already more than 1,000 addresses on the blocklist at any given moment.

Bad bots trying their luck on any one of our servers end up blocked on every MyHost server running Web Hosting.

Deciding what to block

To detect bad bots trying to get in through SSH, we look for some tell-tale patterns that give them away.

One of those signs is brute force entry. That’s where bots attempt lots of failed logins in a short amount of time.

There’s also the similar, but different, slow brute force. That’s like a brute force attack but spread out to stay under the radar.

To protect SSH ports from these attacks, we use a “leaky bucket” mechanism. Every IP address represents a potential bot, so it gets its own bucket. Each failed login adds a splash of water, while the bucket slowly drains. Fail too often, or too fast, and it overflows and the address is blocked.

Slow brute force uses a bigger bucket that drains more slowly. A bot that paces itself to sneak past the first bucket will still fill this one up and get caught.

Now that it’s blocked

When we ban suspected bad bots visiting your websites, we put an automated CAPTCHA code in front of them. That gives them an opportunity to prove they’re human (in case the mechanism judged genuine traffic as a robot).

But with the way that SSH works, blocks don’t offer a second chance mechanism. For that reason, we block SSH access for a period of time. The first time a bot gets blocked, the block lasts one hour. Each consecutive time the same address is caught, the block gets longer.

Our new SSH bad bot blocking system, watches and protects the fleet all at once. Bots attempting logins on different servers are counted together, not in isolation. When a bot's address is flagged, it’s blocked on every protected server—not just the server it tried to access.

You don’t need to do anything

SSH blocking is already up and running on many of our Web Hosting and Email Hosting servers. Like we did with our web traffic protection, it's going to roll out in stages so we can keep a close eye on it.

If you're a Web Hosting or Email Hosting customer, nothing will change with the way you access or use your site or email box. We’re sharing this update just to keep you in the loop, not because you need to do anything. SSH port blocking will just start working once a bad bot reaches your server, and you’ll automatically be more protected from bots.