5 ms·
20 years ago port-knocking was supposed to solve this issue for good but it seems to have been never really been taken up. I'm not sure why.
by bandrami 3y ago
20 years ago port-knocking was supposed to solve this issue for good but it seems to have been never really been taken up. I'm not sure why.
- NavinF 3y agoBecause it doesn't solve any real problems if you have ssh password login disabled and filter out login failures from logs
- bombela 3y agoWith port knocking or a simple as having SSH on a non-standard port, the connection request stops before even opening the TCP connection. That's less load on the system, less logs, less writing to storage, etc. Less of what you don't want must surely be preferable.
- 9dev 3y ago…all for the cost of vastly increased complexity. You’re just micromanaging your pets there. If the load of failed login attempts or the log writes brings your servers down, you have a whole lot of other problems to take care of.
- NavinF 3y agoAre we talking about ssh on an ESP32 or a 2U server? You'd saturate my transit port before I noticed the load on my server or the logs that I filter by default. btw TCP is cheap compared to public key crypto
- corn13read2 3y agoThis is really only effective for password based logins, but most logins these days are key based
- bandrami 3y agoNo, it cuts the DOS resource usage by a factor of 4 because a TCP connection is never opened.
- wkat4242 3y agoPort knocking as it's usually done is easily sniffed. Perhaps using a dynamic TOTP-like time based seed to constantly rotate the ports might help. But it sounds overly complex. It feels very like a "key under the third plant on the right" kinda thing. Not a solid security measure.
- matheusmoreira 3y agoSingle packet authorization. It's like the server is not even there unless you send a cryptographically signed packet https://cipherdyne.org/fwknop/docs/SPA.html https://cipherdyne.org/fwknop/docs/SPA.html
- wkat4242 3y agoNice solution. I hadn't heard of it. I immediately thought of replay attacks because it's a one-way protocol but it looks like they mitigated those as well.
- 0cVlTeIATBs 3y agoMoxie Marlinspike made something to address the simple knock server's problems. https://archive.is/MZKkb https://archive.is/MZKkb
- Gordonjcp 3y agoThis is fine, though. "Security through obscurity is not security" but moving your SSH port to something not 22 will utterly eliminate brute force attacks. It's too much bother to go find it, and the bozos will just move on to the next machine with port 22 open.