8 ms·
It's another layer of security. There have been exploits of OpenSSH in past so this may be prudent.
by benjohnson 5y ago
It's another layer of security. There have been exploits of OpenSSH in past so this may be prudent.
- zbuf 5y agoTrouble with extra layers, there's a point where it results in complexity. Which, in my experience, is more likely to be the root cause of a security problem. I'm not saying this little demo is a disaster or anything. But for example, perhaps it requires an awareness of this scheme in an external firewall's rules, and maybe another machine pops up in the rather large IPv6 range that's now available. At its extreme, these sorts of approaches can bring a lack of clarity which layer is providing the actual security.
- lucb1e 5y agoI actually looked into this a few months ago and if memory serves, the last default setup authentication bypass was in something like 2003. Since then, I think the worst thing has been user enumeration. And 2003 was a very different world in terms of how much we cared about hardening, so ssh being reliable throughout all that time is really quite something.