I just set the port to something > 10000 and configure it to use public key authentication only.
Yeah, me too! I would not call this security by obscurity because it actually helps making the auth logfile more readable ;-)
Changes sshd port every 30 seconds, using Two Factor Auth to login
31–40 of 76 posts
Re: Changes sshd port every 30 seconds, using Two Factor Auth to login
#32I just set the port to something > 10000 and configure it to use public key authentication only.
Isn't it safer to keep the ssh port below 1024 so that another user other than root can't start a listener on that port?
Re: Changes sshd port every 30 seconds, using Two Factor Auth to login
#33I don't understand why this is seen as acceptable, yet port knocking is derided every time it's brought up. Since installing fwknopd more than a year ago, we have had not a single attempt at sshd. Not one. We had a lot before, and it was annoying as hell.
I recognize that this is a joke, in the words of the OP. However I think SPA-type port knocking is completely legitimate, and I second the use of fwknopd. I depend on fwknopd a lot, so if that is not secure idea, I would like someone to point that out to me. NOTE that fwknopd does not depend on expecting a client to connect to a short sequence of different port numbers. That is not what fwknopd does, at least not the latest fwknopd. Instead, fwknopd listens for an encrypted packet on a specified port, which it will not acknowledge. The firewall does not allow the packet through, technically speaking. But fwknopd recognizes the arrival of the packet by scanning logs when the firewall drops the packet and logs the dropped packet. etc. etc. If you know this type of fwknopd deployment and don't think it is a good idea, please comment.
Again, I am not taking the OP seriously, but I do take seriously that people either don't know about fwknopd, or maybe, don't think that is good security (in which case I want to hear from you).
Re: Changes sshd port every 30 seconds, using Two Factor Auth to login
#34Hi, Author of this here! The title "Changes sshd port every 30 seconds, using Two Factor Auth to login" This isn't what the project is about, It was mainly done as a joke for all of the people who say "Changing your port is security by obscurity", and thus the idea came to make a even more insane/silly version of it. It's using "two factor" to generate the port to connect, not to login, there are loads of ways to aut…
> a joke for all of the people who say "Changing your port is security by obscurity"
This always tickled me. I don't do it for security; I do it because (on public-facing servers) it keeps the constant stream of doorknob-rattling out of the logs!
Re: Changes sshd port every 30 seconds, using Two Factor Auth to login
#35Hi, Author of this here! The title "Changes sshd port every 30 seconds, using Two Factor Auth to login" This isn't what the project is about, It was mainly done as a joke for all of the people who say "Changing your port is security by obscurity", and thus the idea came to make a even more insane/silly version of it. It's using "two factor" to generate the port to connect, not to login, there are loads of ways to aut…
> as a joke for all of the people who say "Changing your port is security by obscurity" That's simply not true. Changing the sshd safes you a lot of trouble in risky environments. You prevent services which rely on ssh from failing during automated dos/bf attempts.
It's weird that you trust randomizing the port over a range of [0, 65536) over the trust you have for the cryptographic strength of a 4096-bit RSA key (or equivalent).
Re: Changes sshd port every 30 seconds, using Two Factor Auth to login
#36Earlier quoted context omitted.
Seems possible (though very time-consuming) if you just use it to protect your hobby/toy machines. As soon as your protocol becomes important enough that it attracts the attention of human hackers and not just bots they can easily reverse-engeneer it. By the way, I think you could view encrypted connections as a sort of automation of that practice: A crypto algorithm could be seen as a machine that generates "custom…
That's a interesting idea, to make encryption dynamic using something like the 2FA described here.
Encryption in most commonly used protocols are dynamic - each session generates a brand new session key that are negotiated such that only the holders of the private keys can discern.
Re: Changes sshd port every 30 seconds, using Two Factor Auth to login
#37Earlier quoted context omitted.
> as a joke for all of the people who say "Changing your port is security by obscurity" That's simply not true. Changing the sshd safes you a lot of trouble in risky environments. You prevent services which rely on ssh from failing during automated dos/bf attempts.
Hmmm ... wouldn't it be possible to use a distrubuted portscanner to find the current port? Or simply DDOS the switch that the box is attached to? Or the router? Or another downstream connection point? While I love the ingenuity of the OP's software, I'd have to agree with their own assessment on the Github page "Beware, currently I would not really recommend running this software, it was only written as a joke."
Needing distributed port scanner adds a huge barrier to entry over that needed for a simple ssh brute force script. Not to mention that once you find the port you have at most 30s to brute force it before it moves again...
Re: Changes sshd port every 30 seconds, using Two Factor Auth to login
#38This is a very bad idea. If I suspect you're doing this, I can definitely probe 30k ports silently within a second. How many tries do you think I need to break the last two digits?
Two men walking in the woods enter grizzly country. One stops and swaps his hiking boots for running shoes. The other says, that's stupid, you'll never out run a grizzly bear.
The technical concerns fall under the category of security. The business concerns fall under risk mitigation. These concerns converge as the value of an enterprise's assets rises. Banks and blogs are toward different ends of the spectrum. At the lower end, this sort of measure probably keeps a wordpress site in the middle of the herd when wolves invite themselves to dinner.
Re: Changes sshd port every 30 seconds, using Two Factor Auth to login
#39I would install it, but there is not the usual "wget https:// ... | bash" setup...
Here you go! "wget -O - https://pastebin.com/raw/beiNBca5 | sudo bash"
Re: Changes sshd port every 30 seconds, using Two Factor Auth to login
#40Earlier quoted context omitted.
> as a joke for all of the people who say "Changing your port is security by obscurity" That's simply not true. Changing the sshd safes you a lot of trouble in risky environments. You prevent services which rely on ssh from failing during automated dos/bf attempts.
It's weird that you trust randomizing the port over a range of [0, 65536) over the trust you have for the cryptographic strength of a 4096-bit RSA key (or equivalent).
But is it not true that a random port helps specifically against DoS attacks?