6 ms·

> 22 => 2222 With a well configured SSH server, 22=> 2222 is pointless, very much the definition of obscurity providing zero security. OpenSSH is impeccably w

> 22 => 2222 With a well configured SSH server, 22=> 2222 is pointless, very much the definition of obscurity providing zero security. OpenSSH is impeccably written software, widely battle-tested and its been literally forever since there was any significant vulnerability in it despite being one of the most widely deployed servers on the planet. Enable key/cert only authentication and you are already effectively 100% secure. Then, to double-down: - Harden KexAlgorithms and Ciphers - PermitRootLogin no - Compression delayed - PerSourceMaxStartups - PerSourceNetBlockSize Job done.

goodpoint 4y ago
> Job done. What part of "if there's a remote zero-day" you did not understand?
- traceroute66 4y ago
  > What part of "if there's a remote zero-day" you did not understand? What part of how about you look at CVE and see its been YEARS/DECADES since the last severe vulnerability do you not understand ? OpenSSH zero-day my ass .... if there were any, they would have been found and exploited by now. OpenSSH is written by the same people as OpenBSD. Those guys are OBSESSIVE about writing secure and correct code and they have the track-record to prove it. Fact is there are millions (billions ?) of OpenSSH servers out there exposed to the internet. OpenSSH is not the way hackers are getting in my friend.
  - JohnJamesRambo 4y ago
    Have you ever heard of the Titanic?
    - goodpoint 4y ago
      "its been YEARS/DECADES since the last severe vulnerability" therefore the probability of a new vulnerability in the next 10 years is exactly 0. /s
seydor 4y ago
yet that simple change reduces bot login attempts drastically (2222 is actually quite popular, choose something else)
- bell-cot 4y ago
  True & true. (I used 2222 as an example.com. Vs. giving the port used at $Job, or $PriorJob, or ...)
substation13 4y ago
> With a well configured SSH server, 22=> 2222 is pointless, very much the definition of obscurity providing zero security. This is incredibly naive. Do you remember Heartbleed? Log4J? These were major vulns in software that is widely used, heavily reviewed, deployed by MANGAs, etc.
- 400thecat 4y ago
  Heartbleed was in openssl, and Log4J in java. What does it have to do with openssh ?
  - potatototoo99 4y ago
    One day it will be openssh.
    - traceroute66 4y ago
      > One day it will be openssh. As I said mate, go look at CVE. Its been YEARS/DECADES since the last serious vulnerability in OpenSSH. That's despite being one of the most widely deployed pieces of software on the internet.
      - iwillbenice 4y ago
        Have you ever been responsible for security in a professional sense? Hiding attack surfaces is standard operating procedure. No one with a triple digit IQ seriously thinks any piece of software is going to be secure to infinity.
    - anjbe 4y ago
      When that day comes, a machine running sshd on a high port will have to be wiped, because how can you trust that nobody’s scanned your ports, exploited your server, and eliminated the traces? When an OpenSSH zero‐day gets released, you can bet your bottom dollar people will be scanning full port ranges for SSH servers. And only one of them has to find you. If that’s the scenario you’re worried about, don’t rely on obscure ports. Run your sshd behind a VPN.
P5fRxh5kUvp2th 4y ago
> OpenSSH is impeccably written software, widely battle-tested and its been literally forever since there was any significant vulnerability in it despite being one of the most widely deployed servers on the planet. I know you're lying because it's not written in Rust. /S
asimops 4y ago
FYI, in modern ssh Compression delayed is equal to Compression yes which is the default already. With regards to PerSourceMaxStartups PerSourceNetBlockSize how do you configure it, in order to not make it a DOS vector?
- traceroute66 4y ago
  > how do you configure it, in order to not make it a DOS vector? You use it in conjunction with a third parameter that I forgot to mention, namely MaxStartups. MaxStartups introduces a degree of randomness to the whole process, so you have MaxStartups X:Y:Z where: - X = Reference number of unauthenticated connections ("n") - Y = Percentage probability of dropping when n>X - Z = n=Z == all further unauthenticated connections dropped Additional parameter that may be of interest is LoginGraceTime. Fun fact, MaxStartups/PerSourceMaxStartups/PerSourceNetBlockSize were specifically introduced >6.1 in order to add firepower to combatting unauthenticated connection DoS attacks.

goodpoint 4y ago

> Job done. What part of "if there's a remote zero-day" you did not understand?

traceroute66 4y ago
> What part of "if there's a remote zero-day" you did not understand? What part of how about you look at CVE and see its been YEARS/DECADES since the last severe vulnerability do you not understand ? OpenSSH zero-day my ass .... if there were any, they would have been found and exploited by now. OpenSSH is written by the same people as OpenBSD. Those guys are OBSESSIVE about writing secure and correct code and they have the track-record to prove it. Fact is there are millions (billions ?) of OpenSSH servers out there exposed to the internet. OpenSSH is not the way hackers are getting in my friend.
- JohnJamesRambo 4y ago
  Have you ever heard of the Titanic?
  - goodpoint 4y ago
    "its been YEARS/DECADES since the last severe vulnerability" therefore the probability of a new vulnerability in the next 10 years is exactly 0. /s

seydor 4y ago

yet that simple change reduces bot login attempts drastically (2222 is actually quite popular, choose something else)

bell-cot 4y ago
True & true. (I used 2222 as an example.com. Vs. giving the port used at $Job, or $PriorJob, or ...)

substation13 4y ago

> With a well configured SSH server, 22=> 2222 is pointless, very much the definition of obscurity providing zero security. This is incredibly naive. Do you remember Heartbleed? Log4J? These were major vulns in software that is widely used, heavily reviewed, deployed by MANGAs, etc.

400thecat 4y ago
Heartbleed was in openssl, and Log4J in java. What does it have to do with openssh ?
- potatototoo99 4y ago
  One day it will be openssh.
  - traceroute66 4y ago
    > One day it will be openssh. As I said mate, go look at CVE. Its been YEARS/DECADES since the last serious vulnerability in OpenSSH. That's despite being one of the most widely deployed pieces of software on the internet.
    - iwillbenice 4y ago
      Have you ever been responsible for security in a professional sense? Hiding attack surfaces is standard operating procedure. No one with a triple digit IQ seriously thinks any piece of software is going to be secure to infinity.
  - anjbe 4y ago
    When that day comes, a machine running sshd on a high port will have to be wiped, because how can you trust that nobody’s scanned your ports, exploited your server, and eliminated the traces? When an OpenSSH zero‐day gets released, you can bet your bottom dollar people will be scanning full port ranges for SSH servers. And only one of them has to find you. If that’s the scenario you’re worried about, don’t rely on obscure ports. Run your sshd behind a VPN.

P5fRxh5kUvp2th 4y ago

> OpenSSH is impeccably written software, widely battle-tested and its been literally forever since there was any significant vulnerability in it despite being one of the most widely deployed servers on the planet. I know you're lying because it's not written in Rust. /S

asimops 4y ago

FYI, in modern ssh Compression delayed is equal to Compression yes which is the default already. With regards to PerSourceMaxStartups PerSourceNetBlockSize how do you configure it, in order to not make it a DOS vector?

traceroute66 4y ago
> how do you configure it, in order to not make it a DOS vector? You use it in conjunction with a third parameter that I forgot to mention, namely MaxStartups. MaxStartups introduces a degree of randomness to the whole process, so you have MaxStartups X:Y:Z where: - X = Reference number of unauthenticated connections ("n") - Y = Percentage probability of dropping when n>X - Z = n=Z == all further unauthenticated connections dropped Additional parameter that may be of interest is LoginGraceTime. Fun fact, MaxStartups/PerSourceMaxStartups/PerSourceNetBlockSize were specifically introduced >6.1 in order to add firepower to combatting unauthenticated connection DoS attacks.