11 ms·

"if you are logging in remotely from somewhere that is not your normal haunt, you can remotely add an entry to /etc/hosts.allow to let yourself past the gate"

by gnosis 16y ago

"if you are logging in remotely from somewhere that is not your normal haunt, you can remotely add an entry to /etc/hosts.allow to let yourself past the gate" If you're "not in your normal haunt" and your attempts to log in are blocked by ssh-faker, then how are you going to "remotely add an entry to /etc/hosts.allow to let yourself past the gate"?

pwg 16y ago
Because the way ssh-faker works, it sends an sshd connect string, just like a real sshd, but then waits for you to enter a secret ssh-faker passphrase. If you enter the passphrase, it adds the IP you are connecting from to /etc/hosts.allow and then disconnects. So you first telnet to your ssh port, enter your ssh-faker passphrase, then connect with ssh normally, and log in (hopefully with only key based auth).
- gnosis 16y ago
  So this requires you to first send a password in plain text (ie. unencrypted and open to anyone who sniffs the connection) before you can log in? Why telnet? This really makes no sense whatsoever. Why not just require an extra ssh password? At least that way it couldn't be sniffed. And even that is simply ridiculous, as you could just use one password that's twice as long. What am I not getting here?
  - pwg 16y ago
    It is not perfect. But then, nothing seldom is. What it does protect from, given that most attackers will not have your ssh-faker password, is from the attackers obtaining any access to your sshd to try anything, be it a password scan or whatever. It is another layer in front that deflects all of the script kiddies, and many of the more intelligent attackers. Why telnet? Because ssh-faker is not an sshd, and so you can't submit your password to it using ssh. Perfect, no, another layer, yes. Kind of like having a lock on both your front gate and front door. Those who can't get through the gate lock can not ever attack the door lock. Those who can get through the gate lock still have to then attack the separate door lock.

by gnosis 16y ago

pwg 16y ago

Because the way ssh-faker works, it sends an sshd connect string, just like a real sshd, but then waits for you to enter a secret ssh-faker passphrase. If you enter the passphrase, it adds the IP you are connecting from to /etc/hosts.allow and then disconnects. So you first telnet to your ssh port, enter your ssh-faker passphrase, then connect with ssh normally, and log in (hopefully with only key based auth).

gnosis 16y ago
So this requires you to first send a password in plain text (ie. unencrypted and open to anyone who sniffs the connection) before you can log in? Why telnet? This really makes no sense whatsoever. Why not just require an extra ssh password? At least that way it couldn't be sniffed. And even that is simply ridiculous, as you could just use one password that's twice as long. What am I not getting here?
- pwg 16y ago
  It is not perfect. But then, nothing seldom is. What it does protect from, given that most attackers will not have your ssh-faker password, is from the attackers obtaining any access to your sshd to try anything, be it a password scan or whatever. It is another layer in front that deflects all of the script kiddies, and many of the more intelligent attackers. Why telnet? Because ssh-faker is not an sshd, and so you can't submit your password to it using ssh. Perfect, no, another layer, yes. Kind of like having a lock on both your front gate and front door. Those who can't get through the gate lock can not ever attack the door lock. Those who can get through the gate lock still have to then attack the separate door lock.