11 ms·
IPv6-ghost-ship: Using TOTP as part of an AWS EC2 IPv6 address
- quocanh 5y agoI love this. But also why.
- AdamJacobMuller 5y agoIf you have to ask why, you'll never know.
- snypher 5y agoInstead of building a OTP gateway into each connection, you can just connect to the constantly rotating IP and go from there. Seems useful!
- AdamJacobMuller 5y agoThis is absolutely brilliant and amazing and also completely and utterly useless. I love it.
- kadoban 5y agoCool. That is a pretty bad idea in practice though, the issue(s) being: IP addresses are public (especially to anyone in the middle of your connection) and it's trivially brute-forceable.
- KiranRao0 5y agoDefinitely a cool project. And I agree this is a bad idea in practice for many reasons. But I wasn't aware that TOTP was brute-forcable. What is the mechanism to achieve this (given only a set of IP address and their timestamps)?
- kadoban 5y agoTOTP implemented this way is brute-forceable because you can just connect to all of the IP addresses (or pick however many connections you can practically make in 60 seconds and hit those). There's no way to lock out after N failures or even to rate limit attempts.
- jacob019 5y agoA /80 prefix is equivalent to 65536 ipv4 Internets. Not so brute-forceble.
- lmz 5y agoThe random part is six digits. I'd say pretty brute-forceable.
- AaronFriel 5y agoThe TOTP spec (rfc6238) allows up to 10 digits or 10 billion unique values, a bit bigger than IPv4's space. Running anything like fail2ban on IP address misses would stop brute forcing in its tracks.
- kadoban 5y agoBoth good ideas. None of this fixes even a passive mitm attack, but it's still better.
- yardstick 5y ago> There's no way to lock out after N failures or even to rate limit attempts. Given it’s a single machine with a /80, couldn’t the machine rate limit attempts to any IP in the /80? Ie rate limit by source, and separately rate limit by destination. Cover both bases.
- kadoban 5y agoThe way I understood it, only the correct IP address would even be connected to anything, the rest would just fail. You probably could do something like that, yeah.
- DarylZero 5y agoPutting the IP block over WireGuard fixes both issues.
- kadoban 5y agoIf you're using wireguard don't you already have a secured connection and don't even need any of this?
- DarylZero 5y agoIf the computer is stolen or compromised, but the TOTP device remains secure, then access will be blocked. Actually, occurs to me now, the brute force approach could still be used then, so that does have to be mitigated separately (which is possible).
- georgyo 5y agoI don't think the idea was suggesting that TOTP would be the _only_ method to get in. In fact the code just decides to accept or reject the incoming connection. The normal SSH auth flow would still need to be completed. So you would need to brute force SSH (which is already decently hard) AND brute force the IP every 30 seconds. This would stop the constant and relentless failed auth logs. (Yes there are other methods, but this one is novel and good as well)
- deathanatos 5y agoI love that the submitter fit the entire idea into the title. Understood it without even clicking. Brevity is the soul of wit. Clever idea, wouldn't have thought of it on my own.
- zeptonix 5y agoBrilliant!
- gauravphoenix 5y agoAidan is one of the most brilliant engineering person I have known. I share a slack workspace with him and his posts are always enlightening. Glad to see him on HN front-page.
- wmf 5y agoThis is like port knocking except using the low 48 bits of the IP address instead of the port. Personally I'm not into port knocking but some people are.
- rzzzt 5y agoAdd a local DNS server that rotates the AAAA record in tandem, and voila!
- viraptor 5y agoRisky - both because browsers use DoH more and more, and otherwise DNS cache will be out of sync.
- jl6 5y agoAmazing. But why “ghost ship”?
- Schnitz 5y agoA ghost ship mysteriously appears and disappears in a number of seemingly random locations, presumably leading mariners to follow it to nowhere chasing ghosts.
- eknkc 5y agoI know that even with /80 prefixes on everything we will not run out of IPv6 addresses but why do they provide such large blocks to individual instances, servers etc? Is there any practical reason? Like easier routing? Just curious.
- emteycz 5y agoThat individual instance might host hundreds of LAMP vhosts, each could have its own IP now
- eknkc 5y agoThat individual instance can host 300 trillion vhosts with individual IPs with a /80 block. It has more publicly adressable IP addresses than the entire ipv4 address space. That is exactly my question, is there a technical / practical reason for this? Or is it simply an arbitrary prefix?
- ghshephard 5y agoIPv6 networks, by specification, are (almost) always /64 - that is, your subnetwork can have 2^64 nodes on it - which means that any EUI-64 device (A device with a 64 Bit MAC address - Ethernet Devices with 48 bits commonly extend to 64 bits by stuffing 16 bits (FF:FE) in the middle) can automatically determine its own IPv6 address by just concatenating the Network + MAC address. No Stateful DHCP server required. I'm more curious as to why the /80. This is the very first time I've seen anything less than a /64. Without digging into the details, I'm guessing(?) that the network is a /64 (almost certainly), and on that network there can be /16 nodes (65536), each of which can have /48 (300 Trillion) vhosts. And I thought I had left CIDR behind with IPv4... Sigh.
- reincarnate0x14 5y agoIt's more "why not." The mindset that addresses are something that need to be conserved and carefully parceled out simply does not jive with V6. It takes a while for that to really sink in particularly if one is used to having to care a lot. Who cares if they need 100 or 200 or 500,000. Give them a /64 or /80 and let them use it for whatever they come up with. As to why specifically /64 and /80 it probably makes the internal net magic easier versus something that isn't 4-byte aligned.
- jimmySixDOF 5y agoReminds me of port knocking a little bit lol but it's a cute solution for on the fly obfuscation
- taddevries 5y agoTOTP = Time-based One Time Password For those like me who are bad with remembering acronyms.
- rjsw 5y agoThanks, I'm sure I'm not the only person from the UK who thought it was something else [1]. [1] https://en.wikipedia.org/wiki/Top_of_the_Pops https://en.wikipedia.org/wiki/Top_of_the_Pops