4 ms·
My current take: nftables instead of iptables port-knocking non-standard port key+pass access/auth ip whitelist good logging ED25519 wherever possible!!!
by arca_vorago 8y ago
My current take:
nftables instead of iptables
port-knocking
non-standard port
key+pass access/auth
ip whitelist
good logging
ED25519 wherever possible!!!
- Artemis2 8y agoI love the idea of Single-Packet Authorization with fwknop instead of port knocking: http://www.cipherdyne.org/fwknop/ http://www.cipherdyne.org/fwknop/
- orev 8y agoI wish fwknop would be added to pfsense.
- AlexCoventry 8y agoHow does fwknop compare to knockknock? https://moxie.org/software/knockknock/ https://moxie.org/software/knockknock/
- michaelrash 8y agoThe design decisions that govern fwknop provide guidance on how fwknop is different from knockknock: http://www.cipherdyne.org/fwknop/docs/fwknop-tutorial.html#design http://www.cipherdyne.org/fwknop/docs/fwknop-tutorial.html#d...
- AlexCoventry 8y agoThanks.
- nerdponx 8y agoIP whitelist is tough when your home network has a dynamic IP.
- purple-again 8y agoI called up my provider and paid a little extra for a fixed IP. Really it was just laziness though because in practice my home IP seemed to only change when I restarted the router.
- gsich 8y agoIP-Range would stay relatively similar.
- cbzbc 8y agowhy nftables rather than iptables?
- totony 8y agoIm also curious about this, they use the same netfilter backend
- ptman 8y agoIs that true? I thought nftables was still behind on supported features compared to iptables and nftables runs on a VM. Anyway, nftables should be nicer to administer. More pf-like.
- arca_vorago 8y agoJust looking toward the future. I think bpf is cool but not aimed at production routing that most network techs can approach. nftables fixes so many issues of iptables and is generally viewed as it's replacement. nftables also has a smaller attack surface due to its youth mostly. So I made the choice to go ahead and focus on learning nft. It's been enjoyable.
- thickice 8y agoCurious, what specifically does nftables offer in this context that iptables doesn't ?
- meowface 8y agoNothing wrong with this, but a strong password for all Unix accounts (or, ideally, only allowing SSH with public key authentication) is essentially all you need. Unless you're using a dumb password, you're far more likely to be compromised by an application or OPSEC flaw (like someone getting into the email you used to register your server hosting account) than some crazy SSH compromise.