Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Changes sshd port every 30 seconds, using Two Factor Auth to login

github.com

Post reply on HN
Print view View original

41–50 of 76 posts

Re: Changes sshd port every 30 seconds, using Two Factor Auth to login

#41

Post by curried_haskell »

frutiger wrote: post #35
evook wrote: post #14

Earlier quoted context omitted.

> as a joke for all of the people who say "Changing your port is security by obscurity" That's simply not true. Changing the sshd safes you a lot of trouble in risky environments. You prevent services which rely on ssh from failing during automated dos/bf attempts.

It's weird that you trust randomizing the port over a range of [0, 65536) over the trust you have for the cryptographic strength of a 4096-bit RSA key (or equivalent).

I trust two countermeasures over just one.

Re: Changes sshd port every 30 seconds, using Two Factor Auth to login

#42

Post by TheCoreh »

akshatpradhan wrote: post #21
camperman wrote: post #10

Earlier quoted context omitted.

Aren't you worried that systemd won't silently kill the background process? :)

How would that even be possible?

A new change in systemd made it so that nohup'd processes are killed by systemd after you log out.

Re: Changes sshd port every 30 seconds, using Two Factor Auth to login

#43

Post by mjec »

daraosn wrote: post #13

Is there a service that wraps/proxies a port with a different or custom protocol? (kind of like SSL for HTTP) Idea: instead of ssh'ing a server, you would run your custom command which communicates to port XXXX, communicate with a custom protocol and then if validation succeeds, would proxy to SSH (or any other internal port/protocol). Why? Because as others suggested you could scan all ports very quickly to break th…

There is an existing solution to give you this protection, it's called port knocking.

Re: Changes sshd port every 30 seconds, using Two Factor Auth to login

#44

Post by morb »

akshatpradhan wrote: post #21
camperman wrote: post #10

Earlier quoted context omitted.

Aren't you worried that systemd won't silently kill the background process? :)

How would that even be possible?

He's referring to https://news.ycombinator.com/item?id=11782364

Re: Changes sshd port every 30 seconds, using Two Factor Auth to login

#45

Post by falcolas »

djrogers wrote: post #37
danesparza wrote: post #24

Earlier quoted context omitted.

Hmmm ... wouldn't it be possible to use a distrubuted portscanner to find the current port? Or simply DDOS the switch that the box is attached to? Or the router? Or another downstream connection point? While I love the ingenuity of the OP's software, I'd have to agree with their own assessment on the Github page "Beware, currently I would not really recommend running this software, it was only written as a joke."

Needing distributed port scanner adds a huge barrier to entry over that needed for a simple ssh brute force script. Not to mention that once you find the port you have at most 30s to brute force it before it moves again...

Not so huge.

    nc -z  0-65535
This runs pretty quickly, and if you're co-located with your attacker (i.e. aws), you're not going to be in great shape.

So ultimately, this offers about the same protection against a dedicated attacker that just hosting it on a non-standard port does, with the disadvantage of any clock drift making it much harder to access your own machine.

Re: Changes sshd port every 30 seconds, using Two Factor Auth to login

#47

Post by Nullabillity »

mschuster91 wrote: post #17

Nice idea, but tbh I'd prefer if someone rewrote it in (ba)sh scripts. Not everyone likes to install dozens of different language interpreters/runtimes on his systems - Ruby for puppet, perl is these days mainly used by apt-get, Go, NodeJS, some people use PHP, then Java, the Python version hell with people using either 2.7 or 3.x, Mono, bash, zsh, C, C++... As much as I like flexibility and "the right tool for the r…

I dislike Go as well, but it does compile to a static binary, so you shouldn't need to install any runtime at all.

Re: Changes sshd port every 30 seconds, using Two Factor Auth to login

#48

Post by venomsnake »

benjojo12 wrote: post #4

Hi, Author of this here! The title "Changes sshd port every 30 seconds, using Two Factor Auth to login" This isn't what the project is about, It was mainly done as a joke for all of the people who say "Changing your port is security by obscurity", and thus the idea came to make a even more insane/silly version of it. It's using "two factor" to generate the port to connect, not to login, there are loads of ways to aut…

Couple of enhancements - there should be port map for ports which not to connect to. Also - you will have a hell of a time with synchronization, timezone etc.

Re: Changes sshd port every 30 seconds, using Two Factor Auth to login

#49

Post by rsync »

e40 wrote: post #3

I don't understand why this is seen as acceptable, yet port knocking is derided every time it's brought up. Since installing fwknopd more than a year ago, we have had not a single attempt at sshd. Not one. We had a lot before, and it was annoying as hell.

"I don't understand why this is seen as acceptable, yet port knocking is derided every time it's brought up."

I have been in this business for a long time and I still look very fondly at port-knocking as a thing that genuinely makes things better.

Almost zero complexity added, super stable knockd daemon, and does a single, simple thing very, very well.

I love port knocking, I love using it, I love the idea of it, and I wouldn't build a server without hiding sshd (and others) behind a knock.

All criticism of port knocking (weirdly) assumes that you also disable all other forms of security and that you rely solely on port knocking, which of course is false.

It is true that port knocking adds just a marginal additional amount of security, but it's still additive and it's still a high return on the (very low) complexity and maintenance.

Re: Changes sshd port every 30 seconds, using Two Factor Auth to login

#50

Post by ryanlol »

curried_haskell wrote: post #41
frutiger wrote: post #35

Earlier quoted context omitted.

It's weird that you trust randomizing the port over a range of [0, 65536) over the trust you have for the cryptographic strength of a 4096-bit RSA key (or equivalent).

I trust two countermeasures over just one.

If someone could break 4096 bit ssh keys they could scan every single TCP port on the internet in seconds.
Post reply on HN