4 ms·

I know it's considered security through obscurity but it still makes sense for me to run sshd on a different port. And so it might be a good idea to use a diffe

I know it's considered security through obscurity but it still makes sense for me to run sshd on a different port. And so it might be a good idea to use a different port than 6443 for the Kubernetes API. It doesn't make anything more secure per se but it helps evading automated scanners and reduces noise in the logs which helps in security monitoring.

OJFord 3y ago
Yeah, sometimes I think that quip/rule is unhelpful. The King of England's or US President's driving routes are known only to the convoy and staff who need to know for example, that massively raises the bar for someone hoping to make some kind of disruption to it, it reduces the number of threats/actors they need to worry about it, surely it's fair to say it increases security and that's why they do it. I think the line should be 'obscurity can never provide total security' [but it can be a valuable component].
- Repulsion9513 3y ago
  The driving routes are not obscurity but actual secrets. Similarly, a private key is not obscurity but an actual secret. Something that can be trivially observed (changed port -> nmap, secret obfuscated code in your executable, behavior of your server) is not a secret. That said, obscurity can provide defense-in-depth (i.e. protection against scanning the default port). -- Changing the port can be useful for other reasons too, our pfsense's at work run ssh on 2222 simply because otherwise the logs are absolutely full of scanners getting banned (despite having password auth disabled).
  - OJFord 3y ago
    True, driving routes wasn't a great example. But I think the point stands if you take something like the way they drive (number of vehicles, how they manage junctions, etc.) or which exit they use. You can observe stuff like the way police motorcyclists (I think they call them 'outriders') speed ahead to the next junction, stop traffic, convoy passes through, rear motorcyclists meanwhile catch up to the front of the convoy and the ones holding traffic then adopt their position at the rear, swapping each junction. But there's no benefit to documenting/publicising that (and I'm sure there's nuance to it I haven't picked up on). It's probably also easier to get involved in the police and go on that advanced driving course or whatever and learn all about the techniques they use than it is to actually be assigned to that team - it's not super secret, but the more you keep hidden the harder you make it to be subversive.

OJFord 3y ago

Yeah, sometimes I think that quip/rule is unhelpful. The King of England's or US President's driving routes are known only to the convoy and staff who need to know for example, that massively raises the bar for someone hoping to make some kind of disruption to it, it reduces the number of threats/actors they need to worry about it, surely it's fair to say it increases security and that's why they do it. I think the line should be 'obscurity can never provide total security' [but it can be a valuable component].

Repulsion9513 3y ago
The driving routes are not obscurity but actual secrets. Similarly, a private key is not obscurity but an actual secret. Something that can be trivially observed (changed port -> nmap, secret obfuscated code in your executable, behavior of your server) is not a secret. That said, obscurity can provide defense-in-depth (i.e. protection against scanning the default port). -- Changing the port can be useful for other reasons too, our pfsense's at work run ssh on 2222 simply because otherwise the logs are absolutely full of scanners getting banned (despite having password auth disabled).
- OJFord 3y ago
  True, driving routes wasn't a great example. But I think the point stands if you take something like the way they drive (number of vehicles, how they manage junctions, etc.) or which exit they use. You can observe stuff like the way police motorcyclists (I think they call them 'outriders') speed ahead to the next junction, stop traffic, convoy passes through, rear motorcyclists meanwhile catch up to the front of the convoy and the ones holding traffic then adopt their position at the rear, swapping each junction. But there's no benefit to documenting/publicising that (and I'm sure there's nuance to it I haven't picked up on). It's probably also easier to get involved in the police and go on that advanced driving course or whatever and learn all about the techniques they use than it is to actually be assigned to that team - it's not super secret, but the more you keep hidden the harder you make it to be subversive.