4 ms·
From what I could gather, is that because most port knocking examples use 3 port sequences, that boils down to 3 Unicode characters. Likening that to a password
by rnovak 11y ago
From what I could gather, is that because most port knocking examples use 3 port sequences, that boils down to 3 Unicode characters. Likening that to a password, I think he's saying putting a layer of security in front of SSH, protected only by a 3 character password, is not a great idea, and that he's seen slow brute force attacks that seem to be able to overcome such things.
(Edit: For what it's worth, when I tried out knockd, it supported arbritrary port sequences, so you could easily have a 16 port sequence, making it as robust as you want. Timing however, was quite a pain. I had to use specific timeouts (relative to the RTT time from my network to my VPS), and manually enter each port in the sequence).
Personally, I've found that whitelisting IP's for SSH access, as well as a default block-all policy, disabled root login, and Key authentication have been enough to keep people out of my VPS.
Sure, seeing all of the denied traffic in the logs is annoying, but there's not much you can do about that (other than not log it).
- getsat 11y agoChanging the port to something other than the default (even to something obvious like 22222) will get rid of all the log spam. You could also use something like fail2ban, but changing the port is much simpler.
- rnovak 11y agooh yeah, sorry, I didn't mean to make it out like I was complaining. I log all blocked traffic, so I get data related to ports other than just SSH. I was more lamenting that people even want to attack my VPS, as there's really nothing interesting about it.
- getsat 11y agoIt's not people, though. It's bots! While changing the ssh port adds a comically small amount of security (if any), it isolates you from 99.99% of automated attacks and keeps those logs clean, so I'd recommend it for everyone. Just remember that the port argument to `scp` is -P and not -p like it is for `ssh`. :p
- rnovak 11y agoYeah, I whitelist IPs, and just drop all other packets, so I'm not really worried, but thanks for the advice, it's always good to get other peoples opinions on best practices.
- x0x0 11y agoI think you can just use ssh/config to store ports even for scp; it's much nicer than remembering that stuff.
- cmdrfred 11y agoThis is my setup, except I also run psad.
- notacoward 11y ago"he's saying putting a layer of security in front of SSH, protected only by a 3 character password, is not a great idea" He seems to be missing the point that this is only equivalent to a password if the attacker knows that it's there and can measure whether they've guessed correctly. Sure, if I tell someone that I've used a 48-bit password and allow them to get instantaneous feedback for each attempt, and don't block them completely after N guesses, it's not much of a barrier. On the other hand, if all they see is a non-responsive port and I make timing a factor and I do block them for guessing, it can significantly hamper their ability to make any guesses at the next (ssh) layer. Nobody's suggesting that the three-letter port knocking sequence should be the only security measure taken. It's purely an adjunct or enhancer for other measures, and for that it can be quite effective.
- kazinator 11y ago> Sure, seeing all of the denied traffic in the logs is annoying, but there's not much you can do about that (other than not log it). Yes: you can significantly reduce it by dynamically banning IP addresses which originate it.