4 ms·
close the port open if you dont want ssh to be used. i think i read once the rsync.net dude uses port-knocking and maybe f2b? what was the other note from rach
by out-of-ideas 3y ago
close the port open if you dont want ssh to be used.
i think i read once the rsync.net dude uses port-knocking and maybe f2b? what was the other note from rachaelbythebay, mac os updates always revert changes sshd settings or something like that; maybe they stopped?
i do hate the idea of ip whitelisting; IP's should be more dynamic and less able to fingerprint an individual - but that is opening another can of wurms.
Generally never trust ANY ip; dont use whitelists, and the blacklists should never be "forever". if your app is secured by a keypair like openssh then thats the route to take.
honestly though fail2ban is great in that it does silence some noise in the logs - there will still be an unbareable amount - but at least some less; but still regular log maint is required.
Also the groups Ive seen never recommend f2b for use to fight against a DoS attack; not even for "cleaning up logs" - i dont see where that point was created other than from this page
- kemotep 3y agoI wouldn’t call it a whitelist necessarily but there’s no reason why ssh has to be open to the world if it is possible to use a network overlay or vpn. If ssh is only allowed on the management wireguard network, not much can beat that other than a host compromise which, additional checks to verify that a host can be trusted at that moment could potentially help stop unauthorized access.
- rsync 3y agoI do, indeed, highly value port knocking and I use it in my personal infrastructure. It is simple and elegant and we're coming up on ~20 years of deployment in various places with zero hangs or crashes or unexpected interactions. While nobody should rely solely on port knocking, it is a wonderful layer added to a defense-in-depth strategy. Which is to say: lock down everything the way you always do, then put the port behind a knock.
- out-of-ideas 3y agoI actually want to do this (one day i'll get to nerd-out again) but then tie it to a totp setup so the knocking-algorithm changes ever so slightly; could even utilize different ports
- rsync 3y agoResist, resist. The knock utility (and associated knockd daemon) are simple and resilient - don't make it more complex. Instead, add a simple line to your .login (or whatever) that sends you an SMS every time a successful (three packet) knock occurs. You're the only one that should perform that ... so it would be very interesting if a successful knock occurred without your having knocked ...
- out-of-ideas 3y agosounds fun; i see the arch aur has a few options as well. have you tried https://www.cipherdyne.org/fwknop/ https://www.cipherdyne.org/fwknop/ ?