5 ms·

The number of times I've seen people shitting all over port knocking is truly confusing. Since we added it several years ago, we've not had a single case of ha

by e40 6y ago

The number of times I've seen people shitting all over port knocking is truly confusing. Since we added it several years ago, we've not had a single case of hackers trying to break into sshd. Before port knocking, 100's a day, even though it was on a very unusual port. I try to tell people this, when they poo poo port knocking, but they just don't get it. EDIT: s/the/they/

somedude11 6y ago
The same with "GnuPG is bad" mantra on hackernews. There is nothing better that GPG currently for all its functionality and the only answer you get when asking for substitute is don't use this function or use some obscure application. Yeah right.
- fractionalhare 6y ago
  I agree that there is nothing better than GPG for the narrow scope of encrypting email. But I think there are very few cases where encrypted email is the most secure way to communicate, in lieu of other forms of encryption.
  - somedude11 6y ago
    Encrypted email is almost a marginal usage scenario for GPG compared to other uses. It does everything. It is everywhere.Yes it is big, nobody has to use all of it. Just like C++... oh wait it is unpopular on hacker news bubble too despite being a juggernaut of a language. It will still be relevant long after hacker news will be no more.
  - samatman 6y ago
    I basically use GPG for one thing, at this point: signing git commits. As far as I know, there isn't another GitHub/GitLab compatible way to do this. So I'll keep using GPG until there is.
- wglb 6y ago
  Age is demonstrably better: https://github.com/FiloSottile/age https://github.com/FiloSottile/age Also, an informed analysis of PGP: https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://latacora.micro.blog/2019/07/16/the-pgp-problem.html
  - anonymousse1234 6y ago
    Informed analysis like lack of forward secrecy in something made for non ephemeral communication - for storing, sending files, digital signatures etc. Or backwards compatibility so you can access and verify your backups, archives etc. from 10 or more years ago. Show me ephemeral encryption scheme for something that needs to be readable in the future like that. This analysis is highly uninformed I would say.
  - aborsy 6y ago
    It’s not an informed analysis, or even an analysis at all. That’s not how analyzing algorithms or programs work. Even a basic threat model is missing.
umvi 6y ago
Just respond "don't knock it 'til you try it... or rather, don't try it 'til you knock it!"
tlarkworthy 6y ago
Yes, you have lovely clean logs to audit
mr__y 6y ago
Do you use single-port knocking or a sequence of port-knocks?
- asah 6y ago
  OP would respond but then that would break the obscurity! :-)
crazygringo 6y ago
But serious question -- what exactly is the benefit? Before, it's not like they were getting in anyways if you were using keys. So I confess I still don't "get it". Unless you just want cleaner logs or something. I assume you're still getting the same number of initial connection attempts per day, but just not recording them? Is it something to do with network or CPU consumption related to failed subsequent attempts by the same actor? (Which, the same as port knocking, should be rate limited anyways?)
- jeroenhd 6y ago
  There have been bugs found in SSH server implementations that allowed limited remote code execution or even authentication bypasses. Missing an update or two isn't bad when nobody can figure out how to connect to your server. Of course you have to update at some point. However, if someone drops a zero day on your SSH server while you're asleep you're probably glad that you've got a secret sauce to protect your server, letting the vulnerability bots focus on other servers.
  - cthalupa 6y ago
    If port knocking existing in a vacuum, sure. It'd be great. The issue is there are other options that are better - like VPN only access to SSH - that you can use instead of (or in addition to) If everyone advocating for port knocking was also saying set up VPN only access, sure. It's an additional authorization factor via where ports are used as a proxy for a PIN. But I haven't seen a single person in here saying they use it in addition to a VPN - people are saying it's their primary form of protection. You can setup a wireguard VPN in as much time as it takes to set up port knocking. Now you have all of the benefits port knocking provides, and more. And you could even still set up port knocking in addition to the VPN if you really wanted to, but I would argue there's not much point.
    - surfsvammel 6y ago
      Curious, how does this work? I am not very familiar with VPN. Is the VPN connection setup for the SSH session only? What if someone needs to have multiple SSH session, going to different networks altogether? Im thinking it could be pretty impractical to go onto a whole other network to open an SSH session.
wglb 6y ago
we've not had a single case of hackers trying to break into sshd. that you are aware of.

by e40 6y ago

somedude11 6y ago

The same with "GnuPG is bad" mantra on hackernews. There is nothing better that GPG currently for all its functionality and the only answer you get when asking for substitute is don't use this function or use some obscure application. Yeah right.

fractionalhare 6y ago
I agree that there is nothing better than GPG for the narrow scope of encrypting email. But I think there are very few cases where encrypted email is the most secure way to communicate, in lieu of other forms of encryption.
- somedude11 6y ago
  Encrypted email is almost a marginal usage scenario for GPG compared to other uses. It does everything. It is everywhere.Yes it is big, nobody has to use all of it. Just like C++... oh wait it is unpopular on hacker news bubble too despite being a juggernaut of a language. It will still be relevant long after hacker news will be no more.
- samatman 6y ago
  I basically use GPG for one thing, at this point: signing git commits. As far as I know, there isn't another GitHub/GitLab compatible way to do this. So I'll keep using GPG until there is.
wglb 6y ago
Age is demonstrably better: https://github.com/FiloSottile/age https://github.com/FiloSottile/age Also, an informed analysis of PGP: https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://latacora.micro.blog/2019/07/16/the-pgp-problem.html
- anonymousse1234 6y ago
  Informed analysis like lack of forward secrecy in something made for non ephemeral communication - for storing, sending files, digital signatures etc. Or backwards compatibility so you can access and verify your backups, archives etc. from 10 or more years ago. Show me ephemeral encryption scheme for something that needs to be readable in the future like that. This analysis is highly uninformed I would say.
- aborsy 6y ago
  It’s not an informed analysis, or even an analysis at all. That’s not how analyzing algorithms or programs work. Even a basic threat model is missing.

umvi 6y ago

Just respond "don't knock it 'til you try it... or rather, don't try it 'til you knock it!"

tlarkworthy 6y ago

Yes, you have lovely clean logs to audit

mr__y 6y ago

Do you use single-port knocking or a sequence of port-knocks?

asah 6y ago
OP would respond but then that would break the obscurity! :-)

crazygringo 6y ago

But serious question -- what exactly is the benefit? Before, it's not like they were getting in anyways if you were using keys. So I confess I still don't "get it". Unless you just want cleaner logs or something. I assume you're still getting the same number of initial connection attempts per day, but just not recording them? Is it something to do with network or CPU consumption related to failed subsequent attempts by the same actor? (Which, the same as port knocking, should be rate limited anyways?)

jeroenhd 6y ago
There have been bugs found in SSH server implementations that allowed limited remote code execution or even authentication bypasses. Missing an update or two isn't bad when nobody can figure out how to connect to your server. Of course you have to update at some point. However, if someone drops a zero day on your SSH server while you're asleep you're probably glad that you've got a secret sauce to protect your server, letting the vulnerability bots focus on other servers.
- cthalupa 6y ago
  If port knocking existing in a vacuum, sure. It'd be great. The issue is there are other options that are better - like VPN only access to SSH - that you can use instead of (or in addition to) If everyone advocating for port knocking was also saying set up VPN only access, sure. It's an additional authorization factor via where ports are used as a proxy for a PIN. But I haven't seen a single person in here saying they use it in addition to a VPN - people are saying it's their primary form of protection. You can setup a wireguard VPN in as much time as it takes to set up port knocking. Now you have all of the benefits port knocking provides, and more. And you could even still set up port knocking in addition to the VPN if you really wanted to, but I would argue there's not much point.
  - surfsvammel 6y ago
    Curious, how does this work? I am not very familiar with VPN. Is the VPN connection setup for the SSH session only? What if someone needs to have multiple SSH session, going to different networks altogether? Im thinking it could be pretty impractical to go onto a whole other network to open an SSH session.

wglb 6y ago

we've not had a single case of hackers trying to break into sshd. that you are aware of.