5 ms·

>* Change the default port from 22 to something in the 40k+ range, which will keep you from being scanned, and I'm replying to these suggestions all over this

>* Change the default port from 22 to something in the 40k+ range, which will keep you from being scanned, and I'm replying to these suggestions all over this item because I think it's important, so I apologize if you've since seen this comment elsewhere, but: This introduces new security risks. Non-privileged users can bind on ports in the 40k+ range and cannot bind on 22. If you restart sshd for a software upgrade or some other reason, or the iptables rules you're using to remap the ports get flushed, the malicious non-privileged user can now bind to the port people were communicating with your sshd on, and if they ignore the host key mismatch, everything they send can be captured by the malicious user. Older openssh clients have default configurations that can result in the leak of the whole private key, if you use password auth or 2FA they can outright steal those, perhaps their fake sshd will do more than just steal credentials and will actually mimic a shell and let them gain more understanding of how the system ticks, etc. Is this level of attack something most people are going to run into? No. But neither is an attack more sophisticated than brute force password attempts. It's definitely information people should be keeping in mind when making these sorts of decisions, too.

magicalhippo 6y ago
> This introduces new security risks. Non-privileged users can bind on ports in the 40k+ range and cannot bind on 22. My firewall does port mapping so externally it's not 22, but internally it is.
- cthalupa 6y ago
  This is significantly better than just changing the port the daemon listens on, for sure. There's still public access to SSH, so you're still at risk from a zero day, weak credentials, etc., so I don't think it's quite to ideal levels where you are employing a VPN, disallowing all public access, etc., but at least you're not introducing new potential attack vectors :)
  - magicalhippo 6y ago
    What about VPN makes the VPN server software more secure than the SSH server software?
    - cthalupa 6y ago
      The level of security is cumulative. You do not trust a connection just because it's connected to the VPN. So if your VPN concentrator is compromised via 0day, the only access they get is the same as if things were listening on the public internet. To gain access to the server via SSH they now need both a way in to the VPN and a way in to SSH, vs. just needing a way in via SSH. It doesn't do much if someone just gives up the keys for the VPN and SSH, but it would mean that you would need two simultaneous exploits for the VPN and SSH to gain access.
      - magicalhippo 6y ago
        Yeah but if they compromise the VPN they potentially have access to a lot more than just the SSH server. At least in the setups I've seen deployed.
        cthalupa 6y ago
        I'm not sure I necessarily understand your argument, so my apologies if I'm off here. In scenario 1, you do not gate access via VPN. Things are accessible via the public internet. In scenario 2, you do gate access via VPN. Things are not accessible via the public internet. Someone compromises the VPN. They now have as much access as if there was no VPN and things were accessible to the public internet. In scenario 2, you are more secure than in scenario 1 until the VPN is compromised. You are then just as secure as you were in scenario 1. If you are not restricting access to a VPN in the first place, how would compromising a theoretical VPN result in greater access?
        magicalhippo 6y ago
        In the setups I've seen, once you've connected through VPN you're essentially on the LAN. If you compromise the SSH server, then you're also essentially on the LAN. Yes with the VPN you still have to compromise the server running the SSH service if that's the machine you want access to, but inside the LAN you now have a much greater attack surface. Of course if the setup is VPN -> firewall -> SSH to make sure only the SSH is exposed through VPN, then I agree you'd be more secure with VPN+SSH.

magicalhippo 6y ago

> This introduces new security risks. Non-privileged users can bind on ports in the 40k+ range and cannot bind on 22. My firewall does port mapping so externally it's not 22, but internally it is.

cthalupa 6y ago
This is significantly better than just changing the port the daemon listens on, for sure. There's still public access to SSH, so you're still at risk from a zero day, weak credentials, etc., so I don't think it's quite to ideal levels where you are employing a VPN, disallowing all public access, etc., but at least you're not introducing new potential attack vectors :)
- magicalhippo 6y ago
  What about VPN makes the VPN server software more secure than the SSH server software?
  - cthalupa 6y ago
    The level of security is cumulative. You do not trust a connection just because it's connected to the VPN. So if your VPN concentrator is compromised via 0day, the only access they get is the same as if things were listening on the public internet. To gain access to the server via SSH they now need both a way in to the VPN and a way in to SSH, vs. just needing a way in via SSH. It doesn't do much if someone just gives up the keys for the VPN and SSH, but it would mean that you would need two simultaneous exploits for the VPN and SSH to gain access.
    - magicalhippo 6y ago
      Yeah but if they compromise the VPN they potentially have access to a lot more than just the SSH server. At least in the setups I've seen deployed.
      - cthalupa 6y ago
        I'm not sure I necessarily understand your argument, so my apologies if I'm off here. In scenario 1, you do not gate access via VPN. Things are accessible via the public internet. In scenario 2, you do gate access via VPN. Things are not accessible via the public internet. Someone compromises the VPN. They now have as much access as if there was no VPN and things were accessible to the public internet. In scenario 2, you are more secure than in scenario 1 until the VPN is compromised. You are then just as secure as you were in scenario 1. If you are not restricting access to a VPN in the first place, how would compromising a theoretical VPN result in greater access?
        magicalhippo 6y ago
        In the setups I've seen, once you've connected through VPN you're essentially on the LAN. If you compromise the SSH server, then you're also essentially on the LAN. Yes with the VPN you still have to compromise the server running the SSH service if that's the machine you want access to, but inside the LAN you now have a much greater attack surface. Of course if the setup is VPN -> firewall -> SSH to make sure only the SSH is exposed through VPN, then I agree you'd be more secure with VPN+SSH.