4 ms·
I am very surprised that the OP, and nobody in this thread, has mentioned port knocking. You are absolutely better off / more secure, with port knocking enable
by rsync 13y ago
I am very surprised that the OP, and nobody in this thread, has mentioned port knocking.
You are absolutely better off / more secure, with port knocking enabled. The scans never touch your sshd, because your server does not even answer port 22. As far as the outside world is concerned, you don't run an sshd.
On my own systems, I set up port knocking, I delete the allow rule for the IPs I knocked from every 24 hours (so fresh knocking is needed every day, and I don't leave a trail of "open" IPs as I travel the world) and my .login script spits back at me the current days list of "knocking IPs" so I can immediately note if someone else is knocking.
- Osiris 13y agoThe problem is that it's harder to setup and is less convenient to use. Can you point to any guides that make it simple to set up port knocking? Would it fairly secure to setup a VPN service, connect via VPN, and then SSH in over the VPN connection?
- antocv 13y agoIts easier to go the VPN route than port knocking, but the vpn then ssh is too tinfoil hat for even my taste. As someone else mentioned, just run it on another port than 22, like 53 or 109, and youll get 99% less brute forcing attempts, and dont use passwords as those in the list, and disable user root to authenticate at all. If you're still paranoid about the minor brute forcing attempts left then add the iptables rule to limit connection attempts to 1/min. You're still paranoid? For what really? Port knocking wont help out at this level of paranoia. Hrm, security awareness. Its just not worth the hassle. If you already have OpenVPN setup, then its easy to put the ssh to listen only on the tun interface the vpn server has opened.
- Hello71 13y agoPort knocking: sending a stream of special packets to verify that the user is trusted. Sounds familiar.