4 ms·

As we all know security through obscurity only buys you time like the article points out. Please correct me if I'm wrong but a pretty simple solution exists her

As we all know security through obscurity only buys you time like the article points out. Please correct me if I'm wrong but a pretty simple solution exists here. I run SSH over port 22 and do the following which I think is a pretty reasonable and safe solution (again, please correct me if I'm wrong): 1. Configure a decent firewall, edit iptables and disable anything you aren't or don't plan to use. 2. Disable root login completely. 3. Install fail2ban just in case and set it to block IPs of failed attempts for 2 to 24 hours 4. Use key based authentication and disable SSH logins using passwords altogether. I'd recommend going a step further on number 4 and put a strong password on your key. A lot of people believe that key based authentication in and of itself is enough but if you somehow leak your keys and there's no password on them then an attacker has just easily gained access to your machine. Now I'm guilty of not using a password with my keys because like a lot of people it feels like it defeats the purpose but you can actually set things up so that you only need to enter your password once and it won't ask you for it again for a while just like the sudo "grace period" which lets you sudo without a password after you've entered it once. I do plan to give my keys a password and stop being so lazy in the very near future. I know the Linode library as well as a few posts that have made it to the front page here explain how to do this. Here are the links: http://feross.org/how-to-setup-your-linode/ http://feross.org/how-to-setup-your-linode/ http://news.ycombinator.com/item?id=4618808 http://news.ycombinator.com/item?id=4618808 (Discussion of the above which has some more helpful hints) http://library.linode.com/securing-your-server http://library.linode.com/securing-your-server

gnud 14y ago
When I ran an ssh server on port 22 (with root login and password login turned off), I would see quite a lot of random log-in attempts using root and various stupid passwords. When I switched to some other port, they stopped. Less noise in my logs, hurray! Now, if I see something weird in my logs, chances are it's important.
martinced 14y ago
"As we all know security through obscurity only buys you time..." No. Your definition of "security through obscurity" is totally wrong, so your sentence makes zero sense. If I say: "This server uses port-knocking, you must on three ports between 1..65535 in the correct order before you can attempt to login using SSH on an unknown port" There is absolutely zero security through obscurity here. Just as there's zero security through obscurity when someone says: "I've got a server with SSH on port 22 open, you need a login/password to get in". Attackers do not know the login/password but that is still certainly not "security through obscurity". Just as attackers do not know which three-ports knocking sequence they should use to log in. All they know is that they'll first need to try to find the correct port-knocking sequence amongst the 65536 exp 3 possibilities before being able to try to find the SSH port and then try to force the login/password. Just as using a random SSH port is certainly not "security through obscurity". Security through obscurity is when there's a design or an implementation detail that is obscured. Like when a snake-oil vendors creates a "one-password to store them all" website and doesn't say how it's doing the storing / encryption / authentication / etc. That is security through obscurity. Saying: "You need to know the secret root password to login" or "You need to know the secret port-knocking sequence before the SSH port shall allow" is not, has never been and shall never be "security through obscurity".
- lmm 14y ago
  Bruteforcing 65536^3 sequences is trivial compared to bruteforcing an actual ssh login; what protection you get comes from the fact that the attacker doesn't know there's port-knocking at all. So it really is just obscurity.

gnud 14y ago

When I ran an ssh server on port 22 (with root login and password login turned off), I would see quite a lot of random log-in attempts using root and various stupid passwords. When I switched to some other port, they stopped. Less noise in my logs, hurray! Now, if I see something weird in my logs, chances are it's important.

martinced 14y ago

"As we all know security through obscurity only buys you time..." No. Your definition of "security through obscurity" is totally wrong, so your sentence makes zero sense. If I say: "This server uses port-knocking, you must on three ports between 1..65535 in the correct order before you can attempt to login using SSH on an unknown port" There is absolutely zero security through obscurity here. Just as there's zero security through obscurity when someone says: "I've got a server with SSH on port 22 open, you need a login/password to get in". Attackers do not know the login/password but that is still certainly not "security through obscurity". Just as attackers do not know which three-ports knocking sequence they should use to log in. All they know is that they'll first need to try to find the correct port-knocking sequence amongst the 65536 exp 3 possibilities before being able to try to find the SSH port and then try to force the login/password. Just as using a random SSH port is certainly not "security through obscurity". Security through obscurity is when there's a design or an implementation detail that is obscured. Like when a snake-oil vendors creates a "one-password to store them all" website and doesn't say how it's doing the storing / encryption / authentication / etc. That is security through obscurity. Saying: "You need to know the secret root password to login" or "You need to know the secret port-knocking sequence before the SSH port shall allow" is not, has never been and shall never be "security through obscurity".

lmm 14y ago
Bruteforcing 65536^3 sequences is trivial compared to bruteforcing an actual ssh login; what protection you get comes from the fact that the attacker doesn't know there's port-knocking at all. So it really is just obscurity.