4 ms·
"I do not believe that port knocking and single-packet authentication are good examples of this; both are sort of textbook examples of cosmetic security mechani
by rsync 10y ago
"I do not believe that port knocking and single-packet authentication are good examples of this; both are sort of textbook examples of cosmetic security mechanisms that are made irrelevant by SSH public key authentication."
If there's a remote-root buffer overflow for sshd that does not involve login at all, doesn't hiding the sshd add quite a bit of value ?
That is, there are attack vectors that we know exist, and that we have seen in the past many times for server daemons, that occur before, and override, any authentication mechanism.
By hiding the service, you take yourself out of that population of low hanging fruit ...
You don't find that valuable ? I personally find it extremely valuable and consider port knocking to be one of the very few security optimizations that has such low cost/complexity for such a pronounced and well defined gain. I would not think of deploying an Internet facing system without port knocking on the daemons that don't need public access.[1]
- ryanlol 10y ago>If there's a remote-root buffer overflow for sshd that does not involve login at all, doesn't hiding the sshd add quite a bit of value ? Then the attacker can just compromise every single sshd on the internet and have enough bandwidth to bruteforce most port knocking setups.
- tptacek 10y agoIf you believe that sshd might harbor a preauth RCE --- something that hasn't happened in a very long time --- then deploy real security in front of it: stick it on the other end of a simple encrypted tunnel.
- rsync 10y agoI agree that port knocking is not the christ child. It will not solve world hunger nor will it allow the wolves to lay down with the lambs. But it's something.
- CiPHPerCoder 10y agoIt's the ROT13 of defense mechanisms.
- drudru11 10y agoWhat would you recommend?
- CiPHPerCoder 10y agoSSH key with public key auth over VPN.
- RawInfoSec 10y agoRestrict SSH access inbound to trusted networks only. Then you don't have to worry about all this hoopla.
- vacri 10y agoOne commenter on a previous iteration of this argument said that moving the port (not port knocking per se) made the access logs quieter, and that was reason enough for their use. Edit: heh, same thing is going on a few comments down :)
- crpatino 10y agoROT13 would stop and attacker peeking over everybody's documents, one doc per second, in search for something interesting to actually devote time and resources on. You have to decide if the tradeoff between a thousand bot's scans and a sole eavesdropper noticing the knocking pattern and marking your host as "(incompetently) trying to hide" is really worth it.
- lima 10y ago> It's the ROT13 of defense mechanisms. Not true. Modern port knocking is provably secure and requires network layer attacks to bypass.
- drudru11 10y agoWhat software is this "simple encrypted tunnel"?
- tptacek 10y agoAny of them. Try spiped.
- lima 10y agoMore attack surface, not less.
- dchest 10y agoPicture time! More surface (both spiped and ssh are accepting connections): | → |ssh | → |spiped Less surface (spipe accepts connection, ssh is behind it): | → | spiped ↝ | ssh | With proper configuration, spiped sits in front of ssh, authenticating and decrypting traffic and passing it to ssh. spiped is a tiny program, uses symmetric crypto (small surface). SSH isn't a tiny program, uses more complex asymmetric crypto (larger surface). To learn more: http://www.daemonology.net/blog/2011-07-04-spiped-secure-pipe-daemon.html http://www.daemonology.net/blog/2011-07-04-spiped-secure-pip... To learn how to put it in front of SSH, see https://github.com/Tarsnap/spiped#example-usage https://github.com/Tarsnap/spiped#example-usage
- michaelrash 10y agoThere are some similarities between this and SPA: -> | SPA / fwknop | ssh There are important differences too though (beyond the fact that SPA is not encrypting/decrypting traffic for SSH itself). SPA is a UDP authenticator so it cannot be scanned. Design goals: http://www.cipherdyne.org/fwknop/docs/fwknop-tutorial.html#design http://www.cipherdyne.org/fwknop/docs/fwknop-tutorial.html#d...
- tptacek 10y agoNo, SPA is the first picture: both SPA and OpenSSH are directly responsive to attacker communications. I don't think "attack surface" is the dispositive argument here (the fact that SPA doesn't protect OpenSSH connections at all is), but either way: SPA is inferior to spiped.