Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Changes sshd port every 30 seconds, using Two Factor Auth to login

github.com

Post reply on HN
Print view View original

11–20 of 76 posts

Re: Changes sshd port every 30 seconds, using Two Factor Auth to login

#11

Post by nisa »

noonespecial wrote: post #8
e40 wrote: post #3

I don't understand why this is seen as acceptable, yet port knocking is derided every time it's brought up. Since installing fwknopd more than a year ago, we have had not a single attempt at sshd. Not one. We had a lot before, and it was annoying as hell.

People get their wires crossed about port knocking because it doesn't add much security when I'm trying to find a way to hack you. It does add something when I'm trying randomly to find you to hack. They make the valid criticism of the first case while you argue the second and somehow the arguments miss in the middle.

How does that not add security? If you use a secret token or some authenticated website for opening the port how can an attacker easily circumvent this?

Re: Changes sshd port every 30 seconds, using Two Factor Auth to login

#12

Post by developer2 »

geocar wrote: post #6

This is a very bad idea. If I suspect you're doing this, I can definitely probe 30k ports silently within a second. How many tries do you think I need to break the last two digits?

a) It's not explicitly said that the ssh password is the last digits from the code. That's the intuition I got as well, but that would be pure craziness. I assume only the port is affected, and you're using your normal authentication scheme (key or password) to login.

b) Straight from the GitHub's README, which was not edited after submission to HN:

>> Beware, currently I would not really recommend running this software, it was only written as a joke.

Re: Changes sshd port every 30 seconds, using Two Factor Auth to login

#13

Post by daraosn »

Is there a service that wraps/proxies a port with a different or custom protocol? (kind of like SSL for HTTP)

Idea: instead of ssh'ing a server, you would run your custom command which communicates to port XXXX, communicate with a custom protocol and then if validation succeeds, would proxy to SSH (or any other internal port/protocol).

Why? Because as others suggested you could scan all ports very quickly to break this, but if you scan a port and just receive garbage or something only you can understand when opening it, then you could hide it from the outside..

(Just curious)

Re: Changes sshd port every 30 seconds, using Two Factor Auth to login

#14

Post by evook »

benjojo12 wrote: post #4

Hi, Author of this here! The title "Changes sshd port every 30 seconds, using Two Factor Auth to login" This isn't what the project is about, It was mainly done as a joke for all of the people who say "Changing your port is security by obscurity", and thus the idea came to make a even more insane/silly version of it. It's using "two factor" to generate the port to connect, not to login, there are loads of ways to aut…

> as a joke for all of the people who say "Changing your port is security by obscurity"

That's simply not true. Changing the sshd safes you a lot of trouble in risky environments. You prevent services which rely on ssh from failing during automated dos/bf attempts.

Re: Changes sshd port every 30 seconds, using Two Factor Auth to login

#15

Post by xg15 »

daraosn wrote: post #13

Is there a service that wraps/proxies a port with a different or custom protocol? (kind of like SSL for HTTP) Idea: instead of ssh'ing a server, you would run your custom command which communicates to port XXXX, communicate with a custom protocol and then if validation succeeds, would proxy to SSH (or any other internal port/protocol). Why? Because as others suggested you could scan all ports very quickly to break th…

Seems possible (though very time-consuming) if you just use it to protect your hobby/toy machines. As soon as your protocol becomes important enough that it attracts the attention of human hackers and not just bots they can easily reverse-engeneer it.

By the way, I think you could view encrypted connections as a sort of automation of that practice: A crypto algorithm could be seen as a machine that generates "custom protocols" given a key...

Re: Changes sshd port every 30 seconds, using Two Factor Auth to login

#16

Post by developer2 »

noonespecial wrote: post #8
e40 wrote: post #3

I don't understand why this is seen as acceptable, yet port knocking is derided every time it's brought up. Since installing fwknopd more than a year ago, we have had not a single attempt at sshd. Not one. We had a lot before, and it was annoying as hell.

People get their wires crossed about port knocking because it doesn't add much security when I'm trying to find a way to hack you. It does add something when I'm trying randomly to find you to hack. They make the valid criticism of the first case while you argue the second and somehow the arguments miss in the middle.

If you do not have the ability to eavesdrop on the network between my client and my server, then port knocking is essentially unhackable. Port knocking only fails when the malicious party can monitor the network traffic. This is a valid concern, and I would never say that port knocking by itself is all the security one needs. It does however completely block all regular "outsiders" from ever being able to even open a connection to sshd.

If I require 5 ports to be hit in sequence, and blacklist IPs that hit unknown ports, it is extremely unlikely you will ever connect. Now if someone on my local network, at my ISP, or at my hosting provider sniffs my traffic to determine a static knocking sequence... good for them. They're the one unauthorized person who can connect to sshd, without a valid ssh key to authenticate with.

It's a reality that most businesses are not going to invest in setting up a network that cannot be accessed from the internet at large. For such setups, a little bit of obscurity via something like port knocking to prevent every single port scanner in existence from discovering your sshd server must be better than nothing at all.

Re: Changes sshd port every 30 seconds, using Two Factor Auth to login

#17

Post by mschuster91 »

Nice idea, but tbh I'd prefer if someone rewrote it in (ba)sh scripts. Not everyone likes to install dozens of different language interpreters/runtimes on his systems - Ruby for puppet, perl is these days mainly used by apt-get, Go, NodeJS, some people use PHP, then Java, the Python version hell with people using either 2.7 or 3.x, Mono, bash, zsh, C, C++...

As much as I like flexibility and "the right tool for the right job", we have ended with ridiculously huge install bases - a minimal Debian may very well end up with hundreds of megabytes, it's ridiculous.

Mandatory xkcd: https://xkcd.com/927/

Re: Changes sshd port every 30 seconds, using Two Factor Auth to login

#18

Post by munin »

developer2 wrote: post #16
noonespecial wrote: post #8

Earlier quoted context omitted.

People get their wires crossed about port knocking because it doesn't add much security when I'm trying to find a way to hack you. It does add something when I'm trying randomly to find you to hack. They make the valid criticism of the first case while you argue the second and somehow the arguments miss in the middle.

If you do not have the ability to eavesdrop on the network between my client and my server, then port knocking is essentially unhackable. Port knocking only fails when the malicious party can monitor the network traffic. This is a valid concern, and I would never say that port knocking by itself is all the security one needs. It does however completely block all regular "outsiders" from ever being able to even open a…

> blacklist IPs that hit unknown ports

so what happens when someone hits an unknown port on your system from every IP on the internet?

Re: Changes sshd port every 30 seconds, using Two Factor Auth to login

#19

Post by microtonal »

camperman wrote: post #10
benjojo12 wrote: post #4

Hi, Author of this here! The title "Changes sshd port every 30 seconds, using Two Factor Auth to login" This isn't what the project is about, It was mainly done as a joke for all of the people who say "Changing your port is security by obscurity", and thus the idea came to make a even more insane/silly version of it. It's using "two factor" to generate the port to connect, not to login, there are loads of ways to aut…

Aren't you worried that systemd won't silently kill the background process? :)

I know that you are probably joking, but you'd launch such a thing from a unit file. Hence, no silent killing.

Re: Changes sshd port every 30 seconds, using Two Factor Auth to login

#20

Post by daraosn »

xg15 wrote: post #15
daraosn wrote: post #13

Is there a service that wraps/proxies a port with a different or custom protocol? (kind of like SSL for HTTP) Idea: instead of ssh'ing a server, you would run your custom command which communicates to port XXXX, communicate with a custom protocol and then if validation succeeds, would proxy to SSH (or any other internal port/protocol). Why? Because as others suggested you could scan all ports very quickly to break th…

Seems possible (though very time-consuming) if you just use it to protect your hobby/toy machines. As soon as your protocol becomes important enough that it attracts the attention of human hackers and not just bots they can easily reverse-engeneer it. By the way, I think you could view encrypted connections as a sort of automation of that practice: A crypto algorithm could be seen as a machine that generates "custom…

That's a interesting idea, to make encryption dynamic using something like the 2FA described here.
Post reply on HN