Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Changes sshd port every 30 seconds, using Two Factor Auth to login

github.com

Post reply on HN
Print view View original

61–70 of 76 posts

Re: Changes sshd port every 30 seconds, using Two Factor Auth to login

#61

Post by belorn »

georgeam wrote: post #33
e40 wrote: post #3

I don't understand why this is seen as acceptable, yet port knocking is derided every time it's brought up. Since installing fwknopd more than a year ago, we have had not a single attempt at sshd. Not one. We had a lot before, and it was annoying as hell.

I recognize that this is a joke, in the words of the OP. However I think SPA-type port knocking is completely legitimate, and I second the use of fwknopd. I depend on fwknopd a lot, so if that is not secure idea, I would like someone to point that out to me. NOTE that fwknopd does not depend on expecting a client to connect to a short sequence of different port numbers. That is not what fwknopd does, at least not the…

Correct me if I am wrong here, but would the following changes to SSH give you the same result:

Change protocol from TCP to UPD and port from 22 to 62201.

Remove greeting.

If first message is not the correct password, do not send a reply.

If everyone used this, do you think SSH would become more secure and eliminate password scanners? Personally I think that if ssh took in a fwknopd patch and used that as default, any benefit you see now would disappear. I also suspect that logging every UDP package to 62201 would be a bad idea, probably worse than logging every failed attempt on TCP port 22.

Re: Changes sshd port every 30 seconds, using Two Factor Auth to login

#63

Post by ryanlol »

jjnoakes wrote: post #55
ryanlol wrote: post #50

Earlier quoted context omitted.

If someone could break 4096 bit ssh keys they could scan every single TCP port on the internet in seconds.

What?

If they can break SSH keys like that, they'll easily compromise thousands of servers they can use to scale up their attack.

Re: Changes sshd port every 30 seconds, using Two Factor Auth to login

#64

Post by MereInterest »

TheCoreh wrote: post #42
akshatpradhan wrote: post #21

Earlier quoted context omitted.

How would that even be possible?

A new change in systemd made it so that nohup'd processes are killed by systemd after you log out.

Why would they change that? Isn't that exactly why you would ever nohup a process?

Re: Changes sshd port every 30 seconds, using Two Factor Auth to login

#65

Post by teddyh »

jsmthrowaway wrote: post #60
krastanov wrote: post #40

Earlier quoted context omitted.

But is it not true that a random port helps specifically against DoS attacks?

What on earth does a port have to do with a denial of service? Let's play this out, Mr. Spock: - I have some kind of SSH-specific DoS and will simply enumerate ports until I find SSH, which readily identifies itself right off the bat by nature of the protocol. (No config for that.) Result: DoS successful. - You deploy fail2ban because someone told you to do so because it makes you "safer." Now I can DoS you in three…

Thank you for saving at least me from having to argue this viewpoint again, as I have done in the past:

https://news.ycombinator.com/item?id=6617312

https://news.ycombinator.com/item?id=6482192

You did it even better than I did, I think.

Re: Changes sshd port every 30 seconds, using Two Factor Auth to login

#66

Post by jsmthrowaway »

teddyh wrote: post #65
jsmthrowaway wrote: post #60

Earlier quoted context omitted.

What on earth does a port have to do with a denial of service? Let's play this out, Mr. Spock: - I have some kind of SSH-specific DoS and will simply enumerate ports until I find SSH, which readily identifies itself right off the bat by nature of the protocol. (No config for that.) Result: DoS successful. - You deploy fail2ban because someone told you to do so because it makes you "safer." Now I can DoS you in three…

Thank you for saving at least me from having to argue this viewpoint again, as I have done in the past: https://news.ycombinator.com/item?id=6617312 https://news.ycombinator.com/item?id=6482192 You did it even better than I did, I think.

It's weird that even right-thinking engineers will vehemently argue against just being a lemming on any number of issues, but all it takes is a few "move SSH port to clean up your logs and install fail2ban" guides and here we are.

This really hits people who dabble in operations with a personal server or something. It's probably a failure of operations folks like me to properly reach developers and other groups who simply toy with our dark arts in the pursuit of getting something done. Operating on the Internet is capital H Hazardous, and simply buying a guide wholesale without understanding it even more so.

I am identifying a need.

Re: Changes sshd port every 30 seconds, using Two Factor Auth to login

#67

Post by e12e »

benjojo12 wrote: post #4

Hi, Author of this here! The title "Changes sshd port every 30 seconds, using Two Factor Auth to login" This isn't what the project is about, It was mainly done as a joke for all of the people who say "Changing your port is security by obscurity", and thus the idea came to make a even more insane/silly version of it. It's using "two factor" to generate the port to connect, not to login, there are loads of ways to aut…

Fun project. With my more serious hat on, I think what most people are missing about all these port-knocking schemes -- is that they all boil down to poor key based authentication.

In the case of TOTP, the key is stored in plain text two places: the server and the TOTP client (or similarly, for other port knocking schemes, on the server to calculate the next port, and on the client to do the same).

Contrast this with disabling password login, and using only key-based authentication: Now the secret key is only stored in one place: on the client (although, to be fair, there's a secret key you can steal on the server too, in order to compromise the system).

The way to improve security beyond simply requiring key-based auth, is to move away from trust-on-first-use to using ssh certificates. To improve on that, require certificates and TOTP. It's still somewhat hard to see how the latter really improves on security - perhaps with some kind of dedicated TOTP hw token. I would guess that compromising the TOTP-key stored on a smartphone is probably one of the easiest attack vectors, so it's unclear how much more secure it is, beyond simply using ssh certificates.

Re: Changes sshd port every 30 seconds, using Two Factor Auth to login

#68

Post by teddyh »

jsmthrowaway wrote: post #66
teddyh wrote: post #65

Earlier quoted context omitted.

Thank you for saving at least me from having to argue this viewpoint again, as I have done in the past: https://news.ycombinator.com/item?id=6617312 https://news.ycombinator.com/item?id=6482192 You did it even better than I did, I think.

It's weird that even right-thinking engineers will vehemently argue against just being a lemming on any number of issues, but all it takes is a few "move SSH port to clean up your logs and install fail2ban" guides and here we are. This really hits people who dabble in operations with a personal server or something. It's probably a failure of operations folks like me to properly reach developers and other groups who s…

The problem is that people get unnerved by the log entries showing unsuccessful logins. They get a knee-jerk reaction and the first thing they think of (which will work) is to change the SSH port. What should have stopped them is the feeling that they are now disobeying the internet standards, and the standardized ports are probably standardized for a reason. It’s the same reason anyone should feel a mental pain when considering any quick-and-dirty method of fixing a problem – it is dirty, and will have repercussions.

(The same phenomenon, knee-jerk reactions, could be seen starting in the mid-90s when everybody and their dog had a Solution™ to the e-mail spam problem, leading to canned rebuttals like this: http://craphound.com/spamsolutions.txt)

The proper solution for SSH is probably for the OpenSSH authors to change OpenSSH to no longer log unsuccessful logins (at least by default). If there’s a successful login, the log entry might add how many previous unsuccesful logins there had been within the previous few minutes, but I see no reason at all to log unsuccessful login attempts anymore. The current logging defaults were normal for its time when the code was written, when the internet was very different, but today they are simply scaring people for no reason.

Re: Changes sshd port every 30 seconds, using Two Factor Auth to login

#69

Post by andersonmvd »

e12e wrote: post #67
benjojo12 wrote: post #4

Hi, Author of this here! The title "Changes sshd port every 30 seconds, using Two Factor Auth to login" This isn't what the project is about, It was mainly done as a joke for all of the people who say "Changing your port is security by obscurity", and thus the idea came to make a even more insane/silly version of it. It's using "two factor" to generate the port to connect, not to login, there are loads of ways to aut…

Fun project. With my more serious hat on, I think what most people are missing about all these port-knocking schemes -- is that they all boil down to poor key based authentication. In the case of TOTP, the key is stored in plain text two places: the server and the TOTP client (or similarly, for other port knocking schemes, on the server to calculate the next port, and on the client to do the same). Contrast this with…

Just an observation: 30 seconds should be enough to brute force all ports. It's possible to split the range of the ports by using multiple hosts to perform the scan in case 30 seconds don't be enough.

Re: Changes sshd port every 30 seconds, using Two Factor Auth to login

#70

Post by belorn »

e40 wrote: post #3

I don't understand why this is seen as acceptable, yet port knocking is derided every time it's brought up. Since installing fwknopd more than a year ago, we have had not a single attempt at sshd. Not one. We had a lot before, and it was annoying as hell.

If you chain two sshd and have a certificate on the first and password on the second, the second sshd will have the exact same number of attempts as your current setup.
Post reply on HN