5 ms·

It would be frustrating to be denied access to your own servers because you are traveling and are on a bad IP for some reason. Picture the amount of Captchas y

It would be frustrating to be denied access to your own servers because you are traveling and are on a bad IP for some reason. Picture the amount of Captchas you already getting from a legitimate Chrome instance, but instead of by-passable annoying captchas, you are just locked out.

grepfru_it 2y ago
I have fail2ban configured on one of my servers for port 22 (a hidden port does not have any such protections on it) and I regularly lock out my remote address because I fat finger the password. I would not suggest doing this for a management interface unless you have secondary access
- bartekrutkowski 2y ago
  Why would you use password based auth instead of priv/pub key auth? You'd avoid this and many other security risks.
  - fragmede 2y ago
    what do you if you get mugged and you laptop and phone and keys are taken or stolen from you? or lost? After this party, this guy needed help, he lost his wallet and his phone, his sister also went to the party and gave him a ride there but had left. he didn't know her number to call her, and she'd locked down her socials so we couldn't use my phone to contact her. we were lucky that his socials weren't super locked down and managed to find someone that way, but priv keys are only good so long as you have them.
    - akira2501 2y ago
      I use a yubikey. You need a password to use the key. It has it's own brute force management that is far less punishing than a remote SSH server deciding to not talk to me anymore.
      - fragmede 2y ago
        but what do you do if you don't have the key? unless it's implanted (which, https://dangerousthings.com/ https://dangerousthings.com/), I don't know that I won't lose it somehow.
        akira2501 2y ago
        My keyboard has a built in USB hub and ports. They key lives there. They keyboard travels with me. It's hard to lose. I have a backup key in storage. I have escrow mechanisms. These would be inconvenient, but, it's been 40 years since I've lost any keys or my wallet, so I feel pretty good about my odds. Which is what the game here is. The odds. Famously humans do poorly when it comes to this.
    - usrbinbash 2y ago
      > what do you if you get mugged and you laptop and phone and keys are taken or stolen from you? or lost? My ssh keys are encrypted. They need a password, or they are worthless. Sure, I can mistype that password as well, but doing so has no effect on the remote system, as the ssh client already fails locally.
    - bartekrutkowski 2y ago
      You can and you should back up your keys. There isn't a 100% safe, secure and easy method that shields you from everything that can possibly happen, but there are enough safe, secure and easy ones to cover vast majority of cases other than a sheer catastrophe, which is good enough not to use outdated and security prone mechanisms like passwords on network exposed service.
  - grepfru_it 2y ago
    If I present the incorrect key fail2ban locks me out as well. Two incorrect auth attempts locks out a device for 72 hours. The idea is for regular services which depend on ssh (on port 22) to work regularly (because of key auth) but to block anyone attempting to brute force or otherwise maliciously scan the system. Doesn’t change the advice, if this is your only management interface, don’t enable it :) Also you know you can have MFA even with pw authentication right? :)
semi 2y ago
It would also be very rare. The penalties described here start at 30s, I don't know the max, but presumably whatever is issuing the bad behavior from that IP range will give up at some point when the sshd stops responding rather than continuing to brute force at 1 attempt per some amount of hours. And that's still assuming you end up in a range that is actively attacking your sshd. It's definitely possible but really doesn't seem like a bad tradeoff
hot_gril 2y ago
What's the alternative? If you get onto a bad IP today, you're essentially blocked from the entire Internet. Combined with geolocks and national firewalls, we're already well past the point where you need a home VPN if you want reliable connectivity while traveling abroad.
- AnthonyMouse 2y ago
  What happens when your home VPN is inaccessible from your crappy network connection? There are plenty of badly administered networks that block arbitrary VPN/UDP traffic but not ssh. Common case is the admin starts with default deny and creates exceptions for HTTP and whatever they use themselves, which includes ssh but not necessarily whatever VPN you use.
  - hot_gril 2y ago
    Same as when a crappy network blocks SSH, you get better internet. Or if SSH is allowed, use a VPN over TCP port 22.
    - AnthonyMouse 2y ago
      Better internet isn't always available. A VPN on the ssh port isn't going to do you much good if someone sharing your IP address is doing brute force attempts against the ssh port on every IP address and your system uses that as a signal to block the IP address. Unless you're only blocking connection attempts to ssh and not the VPN, but what good is that? There is no reason to expect the VPN to be any more secure than OpenSSH.
      - hot_gril 2y ago
        If you're using an IP address that's being used to brute force the entire Internet, it's likely that lots of websites are blocking it. If that doesn't matter to you and all you need is to get into a particular SSH server, and also the network blocks VPNs, you're still fine if the SSH is on port 9022 and VPN is port 22. If it's not your own SSH server and it's port 22, then you're still fine if your own VPN is port 22 (on a different host). Hacking into the VPN doesn't get the attacker into the SSH server too, so there's defense in depth, if your concern is that sshd might have a vulnerability that can be exploited with repeated attempts. If your concern is that your keys might be stolen, this feature doesn't make sense to begin with.
1oooqooq 2y ago
lol. depending were you travel the whole continent is already blanket banned anyway. but that only happens because nobody travels there. so it is never a problem.

grepfru_it 2y ago

I have fail2ban configured on one of my servers for port 22 (a hidden port does not have any such protections on it) and I regularly lock out my remote address because I fat finger the password. I would not suggest doing this for a management interface unless you have secondary access

bartekrutkowski 2y ago
Why would you use password based auth instead of priv/pub key auth? You'd avoid this and many other security risks.
- fragmede 2y ago
  what do you if you get mugged and you laptop and phone and keys are taken or stolen from you? or lost? After this party, this guy needed help, he lost his wallet and his phone, his sister also went to the party and gave him a ride there but had left. he didn't know her number to call her, and she'd locked down her socials so we couldn't use my phone to contact her. we were lucky that his socials weren't super locked down and managed to find someone that way, but priv keys are only good so long as you have them.
  - akira2501 2y ago
    I use a yubikey. You need a password to use the key. It has it's own brute force management that is far less punishing than a remote SSH server deciding to not talk to me anymore.
    - fragmede 2y ago
      but what do you do if you don't have the key? unless it's implanted (which, https://dangerousthings.com/ https://dangerousthings.com/), I don't know that I won't lose it somehow.
      - akira2501 2y ago
        My keyboard has a built in USB hub and ports. They key lives there. They keyboard travels with me. It's hard to lose. I have a backup key in storage. I have escrow mechanisms. These would be inconvenient, but, it's been 40 years since I've lost any keys or my wallet, so I feel pretty good about my odds. Which is what the game here is. The odds. Famously humans do poorly when it comes to this.
  - usrbinbash 2y ago
    > what do you if you get mugged and you laptop and phone and keys are taken or stolen from you? or lost? My ssh keys are encrypted. They need a password, or they are worthless. Sure, I can mistype that password as well, but doing so has no effect on the remote system, as the ssh client already fails locally.
  - bartekrutkowski 2y ago
    You can and you should back up your keys. There isn't a 100% safe, secure and easy method that shields you from everything that can possibly happen, but there are enough safe, secure and easy ones to cover vast majority of cases other than a sheer catastrophe, which is good enough not to use outdated and security prone mechanisms like passwords on network exposed service.
- grepfru_it 2y ago
  If I present the incorrect key fail2ban locks me out as well. Two incorrect auth attempts locks out a device for 72 hours. The idea is for regular services which depend on ssh (on port 22) to work regularly (because of key auth) but to block anyone attempting to brute force or otherwise maliciously scan the system. Doesn’t change the advice, if this is your only management interface, don’t enable it :) Also you know you can have MFA even with pw authentication right? :)

semi 2y ago

It would also be very rare. The penalties described here start at 30s, I don't know the max, but presumably whatever is issuing the bad behavior from that IP range will give up at some point when the sshd stops responding rather than continuing to brute force at 1 attempt per some amount of hours. And that's still assuming you end up in a range that is actively attacking your sshd. It's definitely possible but really doesn't seem like a bad tradeoff

hot_gril 2y ago

What's the alternative? If you get onto a bad IP today, you're essentially blocked from the entire Internet. Combined with geolocks and national firewalls, we're already well past the point where you need a home VPN if you want reliable connectivity while traveling abroad.

AnthonyMouse 2y ago
What happens when your home VPN is inaccessible from your crappy network connection? There are plenty of badly administered networks that block arbitrary VPN/UDP traffic but not ssh. Common case is the admin starts with default deny and creates exceptions for HTTP and whatever they use themselves, which includes ssh but not necessarily whatever VPN you use.
- hot_gril 2y ago
  Same as when a crappy network blocks SSH, you get better internet. Or if SSH is allowed, use a VPN over TCP port 22.
  - AnthonyMouse 2y ago
    Better internet isn't always available. A VPN on the ssh port isn't going to do you much good if someone sharing your IP address is doing brute force attempts against the ssh port on every IP address and your system uses that as a signal to block the IP address. Unless you're only blocking connection attempts to ssh and not the VPN, but what good is that? There is no reason to expect the VPN to be any more secure than OpenSSH.
    - hot_gril 2y ago
      If you're using an IP address that's being used to brute force the entire Internet, it's likely that lots of websites are blocking it. If that doesn't matter to you and all you need is to get into a particular SSH server, and also the network blocks VPNs, you're still fine if the SSH is on port 9022 and VPN is port 22. If it's not your own SSH server and it's port 22, then you're still fine if your own VPN is port 22 (on a different host). Hacking into the VPN doesn't get the attacker into the SSH server too, so there's defense in depth, if your concern is that sshd might have a vulnerability that can be exploited with repeated attempts. If your concern is that your keys might be stolen, this feature doesn't make sense to begin with.

1oooqooq 2y ago

lol. depending were you travel the whole continent is already blanket banned anyway. but that only happens because nobody travels there. so it is never a problem.