3 ms·

Or possibly set up port knocking, may be overkill though

tlrobinson 17y ago
Is port knocking a common defense these days? I remember reading about it awhile ago, and thought it was a neat idea but didn't really think people would actually use it.
- brk 17y ago
  I use it. It's really handy, but somewhat cumbersome if you just want to jump on an SSH shell to a box from a new machine. I compromised on some of my boxes and made a non-published/non-linked URL that if you hit it, your source IP will end up on the SSH-allowed list. That plus a non-standard SSH port seems to keep 99.9999% of the risk out of the way without being too overly cumbersome to knock-through when needed.
- deutronium 17y ago
  I don't think it is that popular too be honest, while it is good at preventing access from port scanners etc., the clients aren't standard utilities. [EDIT] You could always just set up iptables to accept traffic from your ISPs subnet and deny the rest.
- Gibbon 17y ago
  I use a simplified one port "port knocker" with iptables setup such that an ascending or descending linear port-scan will leave the ssh port closed upon completion. Only one knock is needed to keep the port open for my current IP address indefinitely, or it can be closed immediately without losing my ssh connection. It also precludes the necessity of filling up iptables with boatloads of DROPs to keep out the riff-raff.
- deleted 17y ago
  [deleted]
- lamnk 17y ago
  IMO port knocking isn't good defense, people can always use nmap to scan for open ports then try some combinations on them. Certificate authentication is way better (in combination with disabling password login)
  - mariorz 17y ago
    Certificate authorization alone may not protect you from 0-day exploits to your ssh server. Not all port knockers use that pinging ports combination technique. Again, I recommend a look at fwknop which addresses your concerns by using certificates actually.
  - ars 17y ago
    Port knocking doesn't use open ports. It acts as a packet sniffer, and doesn't do anything to the port.

Is port knocking a common defense these days? I remember reading about it awhile ago, and thought it was a neat idea but didn't really think people would actually use it.

brk 17y ago
I use it. It's really handy, but somewhat cumbersome if you just want to jump on an SSH shell to a box from a new machine. I compromised on some of my boxes and made a non-published/non-linked URL that if you hit it, your source IP will end up on the SSH-allowed list. That plus a non-standard SSH port seems to keep 99.9999% of the risk out of the way without being too overly cumbersome to knock-through when needed.
deutronium 17y ago
I don't think it is that popular too be honest, while it is good at preventing access from port scanners etc., the clients aren't standard utilities. [EDIT] You could always just set up iptables to accept traffic from your ISPs subnet and deny the rest.
Gibbon 17y ago
I use a simplified one port "port knocker" with iptables setup such that an ascending or descending linear port-scan will leave the ssh port closed upon completion. Only one knock is needed to keep the port open for my current IP address indefinitely, or it can be closed immediately without losing my ssh connection. It also precludes the necessity of filling up iptables with boatloads of DROPs to keep out the riff-raff.
deleted 17y ago
[deleted]
lamnk 17y ago
IMO port knocking isn't good defense, people can always use nmap to scan for open ports then try some combinations on them. Certificate authentication is way better (in combination with disabling password login)
- mariorz 17y ago
  Certificate authorization alone may not protect you from 0-day exploits to your ssh server. Not all port knockers use that pinging ports combination technique. Again, I recommend a look at fwknop which addresses your concerns by using certificates actually.
- ars 17y ago
  Port knocking doesn't use open ports. It acts as a packet sniffer, and doesn't do anything to the port.