3 ms·

No mention of port knocking for SSH. I used to be scanned constantly for SSH logins. So I changed the port. The login attempts stopped for awhile, but eventuall

by daenz 6y ago

No mention of port knocking for SSH. I used to be scanned constantly for SSH logins. So I changed the port. The login attempts stopped for awhile, but eventually they found the port. Now with port knocking, I haven't seen a single attempt. Security by obscurity alone is bad, but as another layer, it can be great.

Majromax 6y ago
> Security by obscurity alone is bad, but as another layer, it can be great. I beg to differ in your case. Had you left SSH on its default port, what would your expected time-to-compromise be? Presumably you weren't using a root:password credential, or else your system would not have remained up enough long enough for you to implement any obscurity. But if an attacker, with full ability to try logins, could not reasonably guess your login credential in the lifetime of the universe (i.e. public key SSH or a strong password), then you've not improved security by moving to a port-knocking model. You have reduced nuisance, but nuisance isn't part of the standard threat model for SSH security. To put it another way: you've not seen another unauthorized login attempt, but would you be comfortable relying on that and use root:password as your access credential?
- daenz 6y ago
  I disagree. Suppose the latest SSH has a 0-day, now I am vulnerable, even though I only use PK-auth. Obscurity is just another layer, and the purpose of layers is to help make rare vulnerabilities (like 0-days) not compromise the system. By hiding the door, they cannot even touch the 0-day without another rare vulnerability.
MaxBarraclough 6y ago
If you don't need to support access from arbitrary IPs, IP whitelisting is another good additional layer over SSH. Keeps the SSH scanners out, and also significantly raises the bar for a determined attacker.

3 ms·

No mention of port knocking for SSH. I used to be scanned constantly for SSH logins. So I changed the port. The login attempts stopped for awhile, but eventuall

by daenz 6y ago

Majromax 6y ago
> Security by obscurity alone is bad, but as another layer, it can be great. I beg to differ in your case. Had you left SSH on its default port, what would your expected time-to-compromise be? Presumably you weren't using a root:password credential, or else your system would not have remained up enough long enough for you to implement any obscurity. But if an attacker, with full ability to try logins, could not reasonably guess your login credential in the lifetime of the universe (i.e. public key SSH or a strong password), then you've not improved security by moving to a port-knocking model. You have reduced nuisance, but nuisance isn't part of the standard threat model for SSH security. To put it another way: you've not seen another unauthorized login attempt, but would you be comfortable relying on that and use root:password as your access credential?
- daenz 6y ago
  I disagree. Suppose the latest SSH has a 0-day, now I am vulnerable, even though I only use PK-auth. Obscurity is just another layer, and the purpose of layers is to help make rare vulnerabilities (like 0-days) not compromise the system. By hiding the door, they cannot even touch the 0-day without another rare vulnerability.
MaxBarraclough 6y ago
If you don't need to support access from arbitrary IPs, IP whitelisting is another good additional layer over SSH. Keeps the SSH scanners out, and also significantly raises the bar for a determined attacker.