3 ms·

Would ssh servers with port knocking set up be safe from this backdoor? I'm not sure I got it correctly, but seems the RCE can only be performed after connecti

by rafpin 3y ago

Would ssh servers with port knocking set up be safe from this backdoor? I'm not sure I got it correctly, but seems the RCE can only be performed after connecting to the ssh server, but if the port is hidden behind a reasonable sequence of tcp/udp knocks, then it won't happen? I've been using port knocking on ssh servers, and it definitely does not replace proper ssh configuration, but so far seems like a cheap extra layer of defense that might either prevent or give extra time to respond when these ssh vulnerabilities appear.

lrvick 3y ago
I do not use or recommend security through obscurity. Such things can always be automatically discovered. https://github.com/eliemoutran/KnockIt https://github.com/eliemoutran/KnockIt Any effort spent on setups like this is likely better spent removing the need for having ssh at all by moving to immutable appliance distros be they specialized like homeassistant or general purpose like TalosOS.
- est 3y ago
  > security through obscurity This is not obscurity, as someone said on HN earlier, good security is good armor, good port knocking is camouflage. They are both important.
- rafpin 3y ago
  > Such things can always be automatically discovered. Wouldn't fail2ban + reasonably sized (10+ ports using a mix of udp and tcp) knock sequence prevent brute force attacks like these?
  - lrvick 3y ago
    You can potentially go down those rabbit holes, then an attacker gets fixated on you for being so unusual and they come back doing only 2 attempts per ip per day with thousands of IPs. I have been on both sides of this game many times. Better time investment in security is just do not have ssh or a shell in production in the first place, because ssh is probably not required for your production application to function.
nebulous1 3y ago
Well, it appears that it would be as safe as any other vulnerable server behind port knocking. Although there's still the possibility that the backdoor is doing something we aren't aware of yet. So yeah, it's as "safe" as you consider port knocking to be. That said, just make sure you aren't using the backdoored versions. I don't see how you can reasonably skip this step.

by rafpin 3y ago

lrvick 3y ago

I do not use or recommend security through obscurity. Such things can always be automatically discovered. https://github.com/eliemoutran/KnockIt https://github.com/eliemoutran/KnockIt Any effort spent on setups like this is likely better spent removing the need for having ssh at all by moving to immutable appliance distros be they specialized like homeassistant or general purpose like TalosOS.

est 3y ago
> security through obscurity This is not obscurity, as someone said on HN earlier, good security is good armor, good port knocking is camouflage. They are both important.
rafpin 3y ago
> Such things can always be automatically discovered. Wouldn't fail2ban + reasonably sized (10+ ports using a mix of udp and tcp) knock sequence prevent brute force attacks like these?
- lrvick 3y ago
  You can potentially go down those rabbit holes, then an attacker gets fixated on you for being so unusual and they come back doing only 2 attempts per ip per day with thousands of IPs. I have been on both sides of this game many times. Better time investment in security is just do not have ssh or a shell in production in the first place, because ssh is probably not required for your production application to function.

nebulous1 3y ago

Well, it appears that it would be as safe as any other vulnerable server behind port knocking. Although there's still the possibility that the backdoor is doing something we aren't aware of yet. So yeah, it's as "safe" as you consider port knocking to be. That said, just make sure you aren't using the backdoored versions. I don't see how you can reasonably skip this step.