6 ms·

"But SSH is a terrible example, because the cost to the defender of simply not having SSH vulnerabilities is the same, or even less, than the cost of obfuscatin

by rsync 6y ago

"But SSH is a terrible example, because the cost to the defender of simply not having SSH vulnerabilities is the same, or even less, than the cost of obfuscating it with nonstandard ports, "port knocking", or fail2ban, which are all silly ideas." I know who I am arguing with here but port knocking is not silly. It's fantastic. When I say fantastic, I don't mean it solves all of our problems and obviates any other protections ... what I mean is, for almost zero cost[1] it adds a non-zero level of actual protection. As a lifelong UNIX sysadmin, it is one of the few totally unalloyed security improvements that I have been able to add to my systems. I believe there are sshd vulns extant that you and I don't know about and port knocking allows me to worry less about them. I also recommend SMS alerts on successful knocks - SMS alerts that you should never see in surprise. This is trivial, by the way, as you can put semicolons in the knock command: /sbin/ipfw add 01021 allow tcp from %IP% to 10.0.0.10 22 setup ; /usr/local/sbin/timestamped_sms 4155551212 "knock from %IP% - " [1] knockd on FreeBSD, 10+ years, not one hang or crash.

cthalupa 6y ago
Why not just block SSH access from the public internet and use a VPN? Trivially easy to setup and more secure than knocking. All it takes is me somehow being able to listen in on your traffic - not even decrypt it - and now I know the knock sequence. I know that you have SSH listening on that server. I know you are actively doing something on it. vs. a VPN where... all I know is you are communicating over a VPN. With DPI I might be able to determine what type of traffic you're sending, but not where it is ultimately going.
- rsync 6y ago
  Again, this is where all port knocking debates devolve to ... Port knocking is not the christ child that will wash away all of our sins ... and therefore is not worth implementing. You're right! It doesn't add that much. But it's non-zero and has almost zero cost. It's very elegant, in my mind, and it makes me very happy.
  - cthalupa 6y ago
    I guess my point is largely: I can set up a VPN in a roughly similar timeframe to setting up port knocking, and it has roughly similar overhead for end user, but the VPN gives me significantly more security while also solving the same issue port knocking does. In that case, why not just set up a VPN instead of port knocking?
    - justinsaccount 6y ago
      Which vpn though? https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=openvpn https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=openvpn https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=pulse+secure https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=pulse+secur... VPN doesn't magically fix all problems. wireguard is good so far, but the kernel implementation is in C, so who knows.
      - cthalupa 6y ago
        No, a VPN isn't magic in and of itself. And yes, I would suggest wireguard for the simplicity and performance these days. I do agree with the author of the original article that security should come in layers Once something is secured with SSH and a VPN, you've got that many more actual layers - you now need a CVE that allows access or credential leak for both the VPN and SSH. (And many of those CVEs don't necessarily allow a random attacker to arbitrarily gain access) https://news.ycombinator.com/item?id=24446919 https://news.ycombinator.com/item?id=24446919 has my list of what the bare minimum SSH protections should be for anything where you are storing customer/user data in my opinion, as well as additional best practices that I have employed.
    - rsync 6y ago
      I will again agree with you that the VPN is a more robust and more complete protection. You are correct. I think the reason I continue to prefer (and evangelize) port knocking is that the intersection of (modest) security gain and simplicity/robustness hits a sweet spot for me. Again, 10+ years in production on many hosts, worldwide, and never so much as a blip. IF knockd were to fail, it would fail in a very boring way. VPNs, on the other hand, are far more complex and they fail in fascinating ways. I am a sysop turned sysadmin - this is my lifes work. I prefer simple, unixy tools that fail in boring ways :)
trishankdatadog 6y ago
Agreed: adding port-knocking and fail2ban in addition to passwordless should not be and are not silly ideas.
crazygringo 6y ago
> I believe there are sshd vulns extant that you and I don't know about and port knocking allows me to worry less about them. That's interesting, that's the first time I've heard a justification for port knocking that actually makes sense to me. I'm curious for others' thoughts here -- are non-public vulnerabilities something you consciously try to mitigate? So that, for example, using 2 different 8-character passwords that are implemented with different technologies, is therefore fundamentally more secure than a single 16-character password? Precisely so that a vulnerability in one is still protected by the other? To me this feels like it's really only applicable if you need to protect your data from hostile governments targeting you specifically, who might actually have zero-days they have weaponized. However, if you're just trying to protect yourself from everyday hackers or even targeted corporate espionage, is unknown vulnerabilities really something that's realistically worth protecting oneself from? (Assuming you're always installing all security patches.)
- CobrastanJorji 6y ago
  I agree. I think this comes down to the Mickens Security Threat Model. Your adversaries come in basically two forms: Mossad and Not-Mossad. If your adversary is Mossad, you've already lost; if a governmental actor wants your data badly enough, they'll get it. If your adversary is not-Mossad, they almost certainly don't have access to any secret zero-day exploits; stay up to date on patches and use good passwords and you'll be fine. Port knocking will almost certainly protect you from not-Mossad, assuming your adversary doesn't know that you're using it. Sure, a small percentage of adversaries are in neither category, and a random hacker dedicated to hitting your specific server may suspect port knocking and could try to circumvent it, but most companies don't have an adversary like that, and even if they do, you've made it harder for them for a small cost.
  - deleted 6y ago
    [deleted]
  - tptacek 6y ago
    I love that article, but this comment beautifully illustrates the problem with it, because unless you believe "19 year old with better-than-normal tooling" counts as "Mossad", it has totally screwed up your perception of the threat model.
viraptor 6y ago
> almost zero cost If it's your private pet server - sure. In larger networks you have to document the access, manage the allowed ports on the network, configure security groups or equivalent on instances, provide alternative steps for people with unusual clients (for example database UI app proxying over SSH), etc. The cost suddenly becomes very non-trivial.
tptacek 6y ago
It solves none of your problems and adds complexity and cost to your defense without corresponding increases to attacker costs. If you believe there are unknown OpenSSH attacks, you can't coherently believe that port knocking is a real defense, since port knocking doesn't do anything to protect the SSH channel that attacks will be carried out in. Instead, if you're actually worried about OpenSSH vulnerabilities, you shouldn't be exposing SSH to the public Internet at all. I'm not super worried about OpenSSH server vulnerabilities, but I would never recommend that teams leave SSH exposed; they should just hide that stuff behind WireGuard.
- ThA0x2 6y ago
  >It solves none of your problems Wrong, it solves tons of them. >adds complexity and cost Almost zero complexity and cost. Maybe if you're a bad at sysadmin work it adds cost and complexity. >defense without corresponding increases to attacker costs. It adds a _huge_, almost incalculable cost increase to attackers. >If you believe there are unknown OpenSSH attacks, you can't coherently believe that port knocking is a real defense, since port knocking doesn't do anything to protect the SSH channel that attacks will be carried out in. Looks like you don't understand the concept of 0-days. Several CVEs we're listed elsewhere. I suggest researching 0-day exploits so you understand how port knocking mitigates them. Port knocking mitigates 0-days. >Instead, if you're actually worried about OpenSSH vulnerabilities, you shouldn't be exposing SSH to the public Internet at all. I don't disagree here, VPN is a great solution. Nonetheless, for some shops simple port-knocking on a bastion host solves, a lot of these issues, and removed the complexity that VPNs add. >I'm not super worried about OpenSSH server vulnerabilities, but I would never recommend that teams leave SSH exposed; they should just hide that stuff behind WireGuard. No one is super worried about things like shellshock, heart bleed, etc. until they happen. Port knocking solved a lot of problems, protects you from zero-days, and makes SSH noise a non-issue (huge signal-to-noise gains). Used in production for years. It's fantastic.
  - tptacek 6y ago
    Port knocking adds a huge, almost incalculable cost increase to attackers. I'm going to remember that one, thanks!
aschatten 6y ago
I understand how port knocking can throw off nmap and reduce brute force traffic. Does it solve anything else? > I believe there are sshd vulns extant that you and I don't know about and port knocking allows me to worry less about them. Wouldn't you need to worry about vulnerabilities in knockd?

by rsync 6y ago

cthalupa 6y ago

Why not just block SSH access from the public internet and use a VPN? Trivially easy to setup and more secure than knocking. All it takes is me somehow being able to listen in on your traffic - not even decrypt it - and now I know the knock sequence. I know that you have SSH listening on that server. I know you are actively doing something on it. vs. a VPN where... all I know is you are communicating over a VPN. With DPI I might be able to determine what type of traffic you're sending, but not where it is ultimately going.

rsync 6y ago
Again, this is where all port knocking debates devolve to ... Port knocking is not the christ child that will wash away all of our sins ... and therefore is not worth implementing. You're right! It doesn't add that much. But it's non-zero and has almost zero cost. It's very elegant, in my mind, and it makes me very happy.
- cthalupa 6y ago
  I guess my point is largely: I can set up a VPN in a roughly similar timeframe to setting up port knocking, and it has roughly similar overhead for end user, but the VPN gives me significantly more security while also solving the same issue port knocking does. In that case, why not just set up a VPN instead of port knocking?
  - justinsaccount 6y ago
    Which vpn though? https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=openvpn https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=openvpn https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=pulse+secure https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=pulse+secur... VPN doesn't magically fix all problems. wireguard is good so far, but the kernel implementation is in C, so who knows.
    - cthalupa 6y ago
      No, a VPN isn't magic in and of itself. And yes, I would suggest wireguard for the simplicity and performance these days. I do agree with the author of the original article that security should come in layers Once something is secured with SSH and a VPN, you've got that many more actual layers - you now need a CVE that allows access or credential leak for both the VPN and SSH. (And many of those CVEs don't necessarily allow a random attacker to arbitrarily gain access) https://news.ycombinator.com/item?id=24446919 https://news.ycombinator.com/item?id=24446919 has my list of what the bare minimum SSH protections should be for anything where you are storing customer/user data in my opinion, as well as additional best practices that I have employed.
  - rsync 6y ago
    I will again agree with you that the VPN is a more robust and more complete protection. You are correct. I think the reason I continue to prefer (and evangelize) port knocking is that the intersection of (modest) security gain and simplicity/robustness hits a sweet spot for me. Again, 10+ years in production on many hosts, worldwide, and never so much as a blip. IF knockd were to fail, it would fail in a very boring way. VPNs, on the other hand, are far more complex and they fail in fascinating ways. I am a sysop turned sysadmin - this is my lifes work. I prefer simple, unixy tools that fail in boring ways :)

trishankdatadog 6y ago

Agreed: adding port-knocking and fail2ban in addition to passwordless should not be and are not silly ideas.

crazygringo 6y ago

> I believe there are sshd vulns extant that you and I don't know about and port knocking allows me to worry less about them. That's interesting, that's the first time I've heard a justification for port knocking that actually makes sense to me. I'm curious for others' thoughts here -- are non-public vulnerabilities something you consciously try to mitigate? So that, for example, using 2 different 8-character passwords that are implemented with different technologies, is therefore fundamentally more secure than a single 16-character password? Precisely so that a vulnerability in one is still protected by the other? To me this feels like it's really only applicable if you need to protect your data from hostile governments targeting you specifically, who might actually have zero-days they have weaponized. However, if you're just trying to protect yourself from everyday hackers or even targeted corporate espionage, is unknown vulnerabilities really something that's realistically worth protecting oneself from? (Assuming you're always installing all security patches.)

CobrastanJorji 6y ago
I agree. I think this comes down to the Mickens Security Threat Model. Your adversaries come in basically two forms: Mossad and Not-Mossad. If your adversary is Mossad, you've already lost; if a governmental actor wants your data badly enough, they'll get it. If your adversary is not-Mossad, they almost certainly don't have access to any secret zero-day exploits; stay up to date on patches and use good passwords and you'll be fine. Port knocking will almost certainly protect you from not-Mossad, assuming your adversary doesn't know that you're using it. Sure, a small percentage of adversaries are in neither category, and a random hacker dedicated to hitting your specific server may suspect port knocking and could try to circumvent it, but most companies don't have an adversary like that, and even if they do, you've made it harder for them for a small cost.
- deleted 6y ago
  [deleted]
- tptacek 6y ago
  I love that article, but this comment beautifully illustrates the problem with it, because unless you believe "19 year old with better-than-normal tooling" counts as "Mossad", it has totally screwed up your perception of the threat model.

viraptor 6y ago

> almost zero cost If it's your private pet server - sure. In larger networks you have to document the access, manage the allowed ports on the network, configure security groups or equivalent on instances, provide alternative steps for people with unusual clients (for example database UI app proxying over SSH), etc. The cost suddenly becomes very non-trivial.

tptacek 6y ago

It solves none of your problems and adds complexity and cost to your defense without corresponding increases to attacker costs. If you believe there are unknown OpenSSH attacks, you can't coherently believe that port knocking is a real defense, since port knocking doesn't do anything to protect the SSH channel that attacks will be carried out in. Instead, if you're actually worried about OpenSSH vulnerabilities, you shouldn't be exposing SSH to the public Internet at all. I'm not super worried about OpenSSH server vulnerabilities, but I would never recommend that teams leave SSH exposed; they should just hide that stuff behind WireGuard.

ThA0x2 6y ago
>It solves none of your problems Wrong, it solves tons of them. >adds complexity and cost Almost zero complexity and cost. Maybe if you're a bad at sysadmin work it adds cost and complexity. >defense without corresponding increases to attacker costs. It adds a _huge_, almost incalculable cost increase to attackers. >If you believe there are unknown OpenSSH attacks, you can't coherently believe that port knocking is a real defense, since port knocking doesn't do anything to protect the SSH channel that attacks will be carried out in. Looks like you don't understand the concept of 0-days. Several CVEs we're listed elsewhere. I suggest researching 0-day exploits so you understand how port knocking mitigates them. Port knocking mitigates 0-days. >Instead, if you're actually worried about OpenSSH vulnerabilities, you shouldn't be exposing SSH to the public Internet at all. I don't disagree here, VPN is a great solution. Nonetheless, for some shops simple port-knocking on a bastion host solves, a lot of these issues, and removed the complexity that VPNs add. >I'm not super worried about OpenSSH server vulnerabilities, but I would never recommend that teams leave SSH exposed; they should just hide that stuff behind WireGuard. No one is super worried about things like shellshock, heart bleed, etc. until they happen. Port knocking solved a lot of problems, protects you from zero-days, and makes SSH noise a non-issue (huge signal-to-noise gains). Used in production for years. It's fantastic.
- tptacek 6y ago
  Port knocking adds a huge, almost incalculable cost increase to attackers. I'm going to remember that one, thanks!

aschatten 6y ago

I understand how port knocking can throw off nmap and reduce brute force traffic. Does it solve anything else? > I believe there are sshd vulns extant that you and I don't know about and port knocking allows me to worry less about them. Wouldn't you need to worry about vulnerabilities in knockd?