4 ms·

One thing I've found amusing is you can cut down SSH hacking attempts to almost zero (at the cost of compatibility with legacy systems) by using very progressiv

by ejrv 8y ago

One thing I've found amusing is you can cut down SSH hacking attempts to almost zero (at the cost of compatibility with legacy systems) by using very progressive encryption. If you force use of ChaCha20/Poly1305, ED25519 and so forth in sshd_config, you'll see these attempts almost disappear. There's probably an observation to be made about just how overwhelmingly many of these attempts come from fairly old software setups.

maxk42 8y ago
Good info! Got any good resources on configuring sshd algos?
- nirv 8y ago
  I highly recommend Mozilla's OpenSSH configuration guideline[1]. [1] https://infosec.mozilla.org/guidelines/openssh#Modern https://infosec.mozilla.org/guidelines/openssh#Modern
- ejrv 8y ago
  Nirv's recommendation below is spot on, but here's a ready-made version as well: https://github.com/ejrv/linuxconfigs/blob/master/etc/ssh/sshd_config https://github.com/ejrv/linuxconfigs/blob/master/etc/ssh/ssh... It's basically a clone of Mozilla's, except enforcing only the very strictest encryption. You can just lift the first 16 lines out of that and merge them into your sshd_config if you don't want to change your existing sshd_config too much.
ethbro 8y ago
Or the ratio of script kiddies to developers.
anonu 8y ago
You mean the ssh handshake will fail... It won't stop an attempt. They just won't get to a password prompt. Right?
asclepi 8y ago
I did that and it bit back when it prevented Transmit from connecting to my servers, with only a generic "Unable to connect" message popping up. This was fixed fairly recently[0], but it's a reminder that using a restricted set of ciphers may not only prevent illegitimate connections from going through. I can confirm from the same experience, however, that it prevents most hacking attempts from ever going to the authentication stage. [0] https://library.panic.com/releasenotes/transmit5/#5-1 https://library.panic.com/releasenotes/transmit5/#5-1

by ejrv 8y ago

maxk42 8y ago

Good info! Got any good resources on configuring sshd algos?

nirv 8y ago
I highly recommend Mozilla's OpenSSH configuration guideline[1]. [1] https://infosec.mozilla.org/guidelines/openssh#Modern https://infosec.mozilla.org/guidelines/openssh#Modern
ejrv 8y ago
Nirv's recommendation below is spot on, but here's a ready-made version as well: https://github.com/ejrv/linuxconfigs/blob/master/etc/ssh/sshd_config https://github.com/ejrv/linuxconfigs/blob/master/etc/ssh/ssh... It's basically a clone of Mozilla's, except enforcing only the very strictest encryption. You can just lift the first 16 lines out of that and merge them into your sshd_config if you don't want to change your existing sshd_config too much.

ethbro 8y ago

Or the ratio of script kiddies to developers.

anonu 8y ago

You mean the ssh handshake will fail... It won't stop an attempt. They just won't get to a password prompt. Right?

asclepi 8y ago

I did that and it bit back when it prevented Transmit from connecting to my servers, with only a generic "Unable to connect" message popping up. This was fixed fairly recently[0], but it's a reminder that using a restricted set of ciphers may not only prevent illegitimate connections from going through. I can confirm from the same experience, however, that it prevents most hacking attempts from ever going to the authentication stage. [0] https://library.panic.com/releasenotes/transmit5/#5-1 https://library.panic.com/releasenotes/transmit5/#5-1