Tor hid the address, not the key
The same SSH public key fingerprint was offered for authentication on three separate days from three different source addresses. Checked against the exit list the Tor Project publishes itself, all three addresses are Tor exit nodes. The circuit changed every time; the key did not, because the key is what the operator carries and the exit is only where the traffic left the network. Addresses are masked to /16 here; the match against the exit list is run against the unmasked values without printing them.
Three login attempts, three different addresses, three different days. The same private key every time.
Someone working through Tor has no fixed address. Each connection can leave the network somewhere else, so blocking the one you saw achieves nothing.
Look at what they offered to log in with instead. Key authentication sends a fingerprint of the public key before anything else happens, and the honeypot records it.
Here is the same fingerprint on three days, from three addresses in different networks.
Now take those addresses and check them against the list the Tor Project publishes of its own exit nodes. All three are on it.
So the address changed every time and the identity did not. The exit is only where the traffic left the network. The key is what the operator brought with them.
You cannot block this by address, and you were never going to. You can still recognise it.
Log key fingerprints, not only addresses.
#linux#security#selfhosted#infosec#sysadmin
❯ Log key fingerprints, not only addresses.