5 ms·
Thoughts on having SSH allow password authentication from the Internet
- darthrupert 2y agoIt can thwart a local keylogger from getting your password. But of course if you have a local keylogger, you're probably quite fucked already. But there's at least some "security in layers" benefit there.
- tjoff 2y agoIf it is a software keylogger then getting the key is even easier...
- nobunaga 2y agoSo this person, as a system administrator, wants to be able to sacrifice security for his personal convenience so he can login from anywhere. Does not sound like a system administrator that actually prioritises the right things. Security, especially if its not your own system, should always come first.
- iforgotpassword 2y agoYou have to balance those two, because the only server that's 100% secure is the one that's powered off. Everyone does that differently. I don't see sshd with key-only auth as dangerous, but password login makes me uncomfortable. Do you drive down to the data center your server is in every time you want to access it? "I'm using VPN" Great now you moved the target from sshd to wireguard.
- deleted 2y ago[deleted]
- PhilipRoman 2y ago>Great now you moved the target from sshd to wireguard I definitely agree with your general sentiment, but in this case wireguard has a much better designed protocol. No response to scans, waaaaay smaller attack surface, no deep integration with a shell that needs to be explicitly disabled depending on use case, no pile of obscure authentication options that you need to make sure to disable...
- deleted 2y ago[deleted]
- nobunaga 2y agoSure, but have you heard of reducing the attack surface? If you need to have to be able to log in at all times then youre probably at a scale that you have oncall processes and multiple people that can respond to incidents at a moments notice and having pub key auth enabled only makes sense. If you dont need that then youre probably small enough that that enablig only public key auth or putting it behind a vpn suffices. And having something like wireguard is much better than having something like password login enabled. Anyone who sacrifices security for convenience is asking for trouble.
- sam_lowry_ 2y agoThe nastiest break in I ever had worked because I installed wget on that server for convenience. It exploited a known Drupal vulnerability to drop in a PHP script that in turn executed wget to download a payload. So I agree about the importance of reducing the attack surface. Now, ssh with password authenticated on a tightly controlled server, without fail2ban, port knocking and other tricky setups is exactly it. A setup with reduced attack surface. > Anyone who sacrifices security for convenience is asking for trouble. The you should switch off your mobile devices, destroy the sim cards and never connect again.
- timewizard 2y ago> This is something that I probably care about more than most people, because as a system administrator I want to be able to log in to my desktop even in quite unusual situations. If I understand correctly you can have your SSH key entirely on a Yubikey if you use PIV or OpenPGP.
- pointlessone 2y agoDoes every random system automatically picks up Yubikey? Does SSH on all platforms find that key?
- deleted 2y ago[deleted]
- jazzyjackson 2y agoUp to date systems should support it since about 2021 To get started you’ll need OpenSSH version 8.2 or later, and you’ll also need libfido2 installed. Windows users may need to use Cygwin for this. https://www.yubico.com/blog/github-now-supports-ssh-security-keys/ https://www.yubico.com/blog/github-now-supports-ssh-security...
- denysvitali 2y agoYes, this. GPG supports smartcards (yes, the plastic smartcards) since ages. The Yubikey will appear as a smartcard on GPG and will work on pretty much sny setup.
- deleted 2y ago[deleted]
- computerfriend 2y agoNow you can drop the PIV or PGP dependencies. OpenSSH can use webauthn to derive SSH keys.
- denysvitali 2y agoI don't agree with the arguments of the author: you can still use a Yubikey (or multiple Yubikeys as a backup) - which is a far more secure option than letting anyone on the internet guess an authentication factor that can be easily cloned (password). No matter your solution, but exposing password-based SSH on the internet is a very bad idea IMHO
- sshine 2y agoI only accept keys on non-standard SSH ports. Less spam traffic, easier to access. Rejecting passwords is just as much a convenience nowadays: I just don't have passwords on my remote machines any more.
- juangacovas 2y agoSame here, PasswordAuthentication is globally No, but I always hold an special username for emergencies which is the only user allowed to login via password (easy at sshd_config file, Match User xxxx then "PasswordAuthentication yes"). Besides emergencies, also works wonders when some sysadmins insist to login via bare metal terminal and cannot use a key...
- jasonm23 2y ago> sysadmins insist to login via bare metal terminal and cannot use a key... In 2024 how is this an employed person.
- fak3r 2y agoThis has been my practice for 20+ years of running SSH, that and using Ansible to keep sshd hardened. https://github.com/dev-sec/ansible-collection-hardening/tree/master/roles/ssh_hardening https://github.com/dev-sec/ansible-collection-hardening/tree...
- sshine 2y agoI also harden my sshd_config. I mainly disabled all legacy cryptography and types of tunnelling/forwarding that I don't rely on: https://gist.github.com/sshine/e42ecb7f9d7432e6df331eefdd490ef8 https://gist.github.com/sshine/e42ecb7f9d7432e6df331eefdd490... I also only expose SSH on public interfaces on one machine; all other machines have SSH over VPN.
- robador 2y agoI was just playing around with this problem. I ended up firewalling the SSH port for all but my personal IP, then have wireguard set up so I can use it from within my wireguard network. Works perfectly so far as long as I have my clients set up.
- l0ng1nu5 2y agoWhy not use port knocking as well?
- rwmj 2y agoWhat's the best way to set up port knocking on a Fedora / Debian server? While not a security measure per se, it adds a layer of obfuscation which blocks random scanners.
- c64d81744074dfa 2y agoNot sure if this is the best, but I use nftables and this article helped me setup port knocking on a debian server: https://home.regit.org/2017/07/nftables-port-knocking/ https://home.regit.org/2017/07/nftables-port-knocking/ Then I added a tripwire feature to make it less likely that a random port traversal would be successful. Here's a snippet of my nftables.conf: define KNOCK_PORT1 = 20000 define KNOCK_PORT2 = 30000 define KNOCK_PORT3 = 10000 define TRIPWIRE_PORT1 = 15000 define TRIPWIRE_PORT2 = 25000 table inet filter { . . set allowed_ssh { type ipv4_addr flags timeout elements = { $HOME_IP, $OTHER_SERVER_IP } } # track port knocking set knock1 { type ipv4_addr timeout 5s } set knock2 { type ipv4_addr timeout 5s } set banned { type ipv4_addr timeout 1m } # handle port knocking chain raw { type filter hook prerouting priority raw; policy accept; ip saddr @banned tcp dport { $KNOCK_PORT1, $KNOCK_PORT2, $KNOCK_PORT3} log prefix "nft banned: " drop tcp dport $KNOCK_PORT1 set add ip saddr @knock1 log prefix "nft knock1: " drop ip saddr @knock1 tcp dport $TRIPWIRE_PORT1 set add ip saddr @banned log prefix "nft tripwire1: " drop ip saddr @knock1 tcp dport $KNOCK_PORT2 set add ip saddr @knock2 log prefix "nft knock2: " drop ip saddr @knock2 tcp dport $TRIPWIRE_PORT2 set add ip saddr @banned log prefix "nft tripwire2: " drop ip saddr @knock2 tcp dport $KNOCK_PORT3 set add ip saddr @allowed_ssh log prefix "nft knock3: " drop } }
- doorsopen 2y agoPort knocking is so 2014. Single Packet auth for publicly exposed hidden services is great: https://github.com/mrash/fwknop https://github.com/mrash/fwknop
- sam_lowry_ 2y agoI configure password login for root on on standard port for all servers I personally control. Moreover, they all have the same root password. Over the 20+ years, I witnessed a few security incidents. None was related to ssh, let alone a break in via a weak password. But I ran into many situations when I needed immediate access to the server and this setup saved my day, my money and my nerves.
- jand 2y agosry to be that guy (with a snarky comment): > Over the 20+ years, I witnessed a few security incidents. As you said, the attackers who breached your system had ssh root access and you had no chance to detect them.
- sam_lowry_ 2y agoAttackers attack for a reason. For targets like my servers, they mostly want to install mining software or a DDoS bot. This is detectable via cpu or network monitoring. I assume if someone wanted to extort money from me after encrypting the disks on my servers, I would also be somehow informed.
- akdor1154 2y agoI allow password from the internet only alongside a TOTP code.. Still gives me a backup in case of unforeseen situations but a step above plain password auth.
- enkrs 2y agoIf the argument for a password login is being able to log in from anywhere, just store a spare ssh key (password protected) in your gmail or similar that's reasonably safe and accessible from anywhere. But I'm having hard time imagining those "anywhere" machine scenarios. Strangers machines that you trust enough to connect to your servers, and are able to install putty or your preferred ssh client of choice on? Better just have SSH on your own phone and laptop.
- sam_lowry_ 2y ago> I'm having hard time imagining those "anywhere" scenarios Hold my beer. You ski in the Alps, its noon, and you get an alert that your DB is down. You know this may happen because of invasive bots, and you know what to do, so you just find a calm spot at the high-altitude cafe, ssh from the phone, find the infringing bot's IPs, block them with ipset and send yourself an email to deal with the problem properly later. Then you ski happily until dusk, knowing that users won't be affected.
- sam_lowry_ 2y agoAnother one: you sold an online business and forgot about it until the moment the buyer contacts you asking for a meeting exactly when you decide whether you want to go to the bomb shelter or risk staying in the appartment building so conveniently located next to a damb that protects Kyiv from flooding. You decide that staying on the 9th floor on the path of cruise missiles to the damb is too risky, pick your good old Toughbook that has enough juice to last until dawn, and go downstairs, asking the buyer over phone to reset the root password and send it over whatsapp. Once installed in the shelter, you quickly realize the disk is full, clean the logs and give furter instructions to the buyer to pass on to his IT.
- teruakohatu 2y agoInstead: you WhatsApp your public ssh key to the buyer and login once they confirm your key has been added. I have had to send my ssh pub key over all sorts of messaging platforms.
- WhyNotHugo 2y agoI use a Yubikey with ssh keys, and suddenly I have my ssh keys available anywhere, while I also avoid them being stored in any single host.
- AnonymousPlanet 2y agoThe first time I actually read this as "... and suddenly I can lose my ssh keys anywhere"
- pluto_modadic 2y agowhy not both? :D
- WhyNotHugo 2y agoBest practice is to have a backup key.
- AnonymousPlanet 2y agoWhile someone else has the original?
- markuman123 2y agoThree layer of defense on default Port here. 1. ufw limit ssh. 2. Ansible devsec.hardening.ssh_hardening 3. fail2ban
- ruthmarx 2y agoIt's convenient and fail2ban/crowdsec is generally a sufficient safeguard. Bruteforcing isn't realistic so you just have to keep an eye on vulns. Key auth is obviously better, but password auth is not as bad as many people like to pretend.
- cyberpunk 2y agoI just stick remote access on tailscale interfaces these days. If something goes astronomically wrong I can get in via my cloud providers console access too. I really don’t understand why people run sshd on the open internet anymore.
- kazinator 2y agoThe analysis in this article is incomplete, due to missing some information which are relevant to its conclusions. It is an established pattern with his blog. Curious how it keeps showing up on the front page of HN. > As everyone with an Internet-exposed SSH daemon knows, attackers are constantly attempting password guesses against various accounts. But if you're using a strong password, the odds of an attacker guessing it are extremely low. The odds are zero if they are trying the wrong account names! SSH password guessers are not probing the space of possible user names, only passwords. Look at your logs, man. For instance, they assume that the superuser account is named root. If you don't call it root, your password could be "password" or even blank and they will never get in. What OpenSSH needs is a your server configuration where you specify a list of allowed user names. > [not accepting password authentication] stops an attacker that can steal and then crack your encrypted passwords What? If the attacker steals your shadow file, they must already somehow have root. At that point, they don't have to care what you think about SSH authentication. They can leave ways for themselves to have repeated access. > In practice, (OpenSSH) password authentication is a complex piece of code that interacts with things like your system's random set of PAM modules. Does any of that code execute for user IDs not listed in the AllowUsers variable in sshd_config? If I have this: AllowUsers = 3CDF4497 will sshd execute all the PAM code and whatnot for a login attempt for user root? This mechanism also solves the problem of some new software installation adding an administrative account with a known password. And maybe don't go installing random crap on the machine that serves you SSH access. Okay sure, there can be this vanishingly improbable flow of events. Somehow a malicious actor knows the above root username. They're a fired IT employee, and the organization forgot to change that name, only the password. The employee uses their knowledge of the secret these are ID to attack a vulnerability in in the password auth stack.
- nickdothutton 2y agoHad my mind drifting back to days of S/Key [1] and little scraps of paper with crossings out on them. [1] https://en.wikipedia.org/wiki/S/KEY https://en.wikipedia.org/wiki/S/KEY
- TMWNN 2y agoIt's still a very valid solution. I used S/KEY for years when I wanted to log into a remote system from a machine I didn't control. I didn't care so much about keystrokes being intercepted; I did care about my password being intercepted. S/KEY (or OPIE, depending on system) let me log in/sudo without exposing said password. I never carried around a preprinted list of codes, rather using a generator on my PDA. It's possible to do the same thing with `pam_google_authenticator`; that is, having that OTP being the only required password, for the same reason. Nowadays this is the easier solution to go with,[1] because there are multiple OTP generator clients on all platforms, but almost all tutorials assume OTP being used for 2FA and not the only password so some more familarity with PAM beyond the tutorials is needed. [1] Barring the requirement for read/write access to the secrets file, which SELinux complicates
- silisili 2y agoI've found that just moving it off 22 reduced credential guessing attempts by 100%.
- commandersaki 2y agoI allow password based auth to my VPS because keys are not always a possibility, and I listen on port 22 (and port 25, 465, 587, 993) because I like the convenience. However I use some simple restrictions such as AllowUsers and pubkey auth only for root. I think this is a reasonable defence against typical ssh dictionary attacks.