Changes sshd port every 30 seconds, using Two Factor Auth to login
1–10 of 76 posts
Re: Changes sshd port every 30 seconds, using Two Factor Auth to login
#2Previous discussion: https://news.ycombinator.com/item?id=11750003
Re: Changes sshd port every 30 seconds, using Two Factor Auth to login
#3I don't understand why this is seen as acceptable, yet port knocking is derided every time it's brought up.
Since installing fwknopd more than a year ago, we have had not a single attempt at sshd. Not one. We had a lot before, and it was annoying as hell.
Re: Changes sshd port every 30 seconds, using Two Factor Auth to login
#4Hi, Author of this here!
The title "Changes sshd port every 30 seconds, using Two Factor Auth to login"
This isn't what the project is about, It was mainly done as a joke for all of the people who say "Changing your port is security by obscurity", and thus the idea came to make a even more insane/silly version of it.
It's using "two factor" to generate the port to connect, not to login, there are loads of ways to authenticate SSH with TOTP tokens, but this is not that.
Re: Changes sshd port every 30 seconds, using Two Factor Auth to login
#5I don't understand why this is seen as acceptable, yet port knocking is derided every time it's brought up. Since installing fwknopd more than a year ago, we have had not a single attempt at sshd. Not one. We had a lot before, and it was annoying as hell.
Unfortunately people have taken this a little too seriously, I wrote this as a joke/PoC of silly "Security by obscurity" methods, and yet people are for some reason viewing this as a serious solution...
Re: Changes sshd port every 30 seconds, using Two Factor Auth to login
#6This is a very bad idea.
If I suspect you're doing this, I can definitely probe 30k ports silently within a second. How many tries do you think I need to break the last two digits?
Re: Changes sshd port every 30 seconds, using Two Factor Auth to login
#7I don't understand why this is seen as acceptable, yet port knocking is derided every time it's brought up. Since installing fwknopd more than a year ago, we have had not a single attempt at sshd. Not one. We had a lot before, and it was annoying as hell.
It does seem a little silly, the readme does also mention it was written as a joke.
Was looking at ways to decrease logspam from ssh login bots some years ago, port knocking seemed like the most elegant solution. I ended up simply moving ssh away from port 22, the logspam disappeared.
I've used fail2ban in other setups, it also has the advantage of being easy to integrate with other systems such as wordpress, sftp/ftps, nginx, apache.
Re: Changes sshd port every 30 seconds, using Two Factor Auth to login
#8I don't understand why this is seen as acceptable, yet port knocking is derided every time it's brought up. Since installing fwknopd more than a year ago, we have had not a single attempt at sshd. Not one. We had a lot before, and it was annoying as hell.
People get their wires crossed about port knocking because it doesn't add much security when I'm trying to find a way to hack you. It does add something when I'm trying randomly to find you to hack.
They make the valid criticism of the first case while you argue the second and somehow the arguments miss in the middle.
Re: Changes sshd port every 30 seconds, using Two Factor Auth to login
#9This is a very bad idea. If I suspect you're doing this, I can definitely probe 30k ports silently within a second. How many tries do you think I need to break the last two digits?
The very description of the project says "Take security by obscurity to the next level (You must be insane to run this)", so I'm not sure why you're trying to convince the author here.
Re: Changes sshd port every 30 seconds, using Two Factor Auth to login
#10Hi, Author of this here! The title "Changes sshd port every 30 seconds, using Two Factor Auth to login" This isn't what the project is about, It was mainly done as a joke for all of the people who say "Changing your port is security by obscurity", and thus the idea came to make a even more insane/silly version of it. It's using "two factor" to generate the port to connect, not to login, there are loads of ways to aut…
Aren't you worried that systemd won't silently kill the background process? :)