3 ms·
Lots of suggestions to place SSH behind other protocols or obfuscate the port number here. Let's be clear about one thing, OpenSSH is the least insecure service
by xorcist 6y ago
Lots of suggestions to place SSH behind other protocols or obfuscate the port number here. Let's be clear about one thing, OpenSSH is the least insecure service you are running. A lot of talented people have audited that code many times over. It may show its age but it is an order of magnitude simpler than SSL. Every pre-auth process is sandboxed.
Most breaches are caused by bad passwords. Use keys, or enforce good passwords, before doing anything else. That VPN might well be less secure, and port knocking is just an unusual authentication with a really short password.
- wlll 6y agoRunning SSH on a non-standard port alone isn't worth much, but it's defense in depth. You don't have to not do all the other things if you run SSH on a non-standard port.
- mercer 6y agoOne really valuable thing for me about running SSH on a non-standard port is that it dramatically decreases the noise in my logs. That's not irrelevant!
- orev 6y agoPort knocking is not really “just a bad password”, as long as you are using it in conjunction with another secure service like SSH. However, you can get the same effect as port knocking with none of the drawbacks using single packet authorization like fwknop if you don’t want to go full VPN.