3 ms·
Disable password auth and ensure you have another way in if necessary. Fail2ban, changing ports and port knocking doesn't really add anything more unless you're
by rascul 11y ago
Disable password auth and ensure you have another way in if necessary. Fail2ban, changing ports and port knocking doesn't really add anything more unless you're concerned about log sizes, and just increases the hassle for you.
Mozilla's wiki has some information on strengthening the security of your OpenSSH setup.
https://wiki.mozilla.org/Security/Guidelines/OpenSSH https://wiki.mozilla.org/Security/Guidelines/OpenSSH
- segmondy 11y agowhat do you mean by port knocking doesn't really add anything? It sure does. Use a good port knocker. ie. http://www.thoughtcrime.org/software/knockknock/ http://www.thoughtcrime.org/software/knockknock/
- rascul 11y agoUse the stuff from that Mozilla wiki page and OpenSSH will be secure enough already. Unless more vulnerabilities are found that apply to such a configuration, or keys are compromised, port knocking in this case isn't going to stop anyone that OpenSSH wouldn't already stop on its own. It's effectively just a pointless layer of security that only adds more hassle to connect. I'm not saying that port knocking doesn't have uses, just that it doesn't in this case. Unless you're trying to hide the service I guess, but I don't see why that would be necessary.
- sliken 11y agoIt adds no security. Assuming you use keypairs the attacker either has your private key or he doesn't. If they compromise your client to the point of having your private key they are likely to have access to whatever port knocker magic you have in place.