181–186 of 186 posts
Earlier quoted context omitted.
I love the idea of Single-Packet Authorization with fwknop instead of port knocking: http://www.cipherdyne.org/fwknop/
How does fwknop compare to knockknock? https://moxie.org/software/knockknock/
Earlier quoted context omitted.
The original question was: what's the risk, or threat model. I believe that's been adequately addressed.
The other question is whether other risks are greater; if a high port number is your only choice, or handled by port forwarding on a router, or you are the only user, or high numbers are scanned sufficiently less often, then maybe you still choose one.
Restricting the remote IP range is another option.
To prevent even those initial attempts, I use multiple layers of defenses such as country based blocking or blacklist based blocking. If an attacker slips through despite all this, I blacklist them manually in /etc/hosts.deny.
If there is any interest, my scripts are in https://github.com/KamarajuKusumanchi/hosts.deny/
Earlier quoted context omitted.
How does fwknop compare to knockknock? https://moxie.org/software/knockknock/
The design decisions that govern fwknop provide guidance on how fwknop is different from knockknock: http://www.cipherdyne.org/fwknop/docs/fwknop-tutorial.html#d...
Earlier quoted context omitted.
I can’t think of any way it could be otherwise, but please, feel free to enlighten us all how a non-standard port number adds any more security than would an additional 16-bit key.
Non-standard ports, port knocking and similar things work before anything reaches sshd; so they can mitigate vulnerabilities in sshd. Obviously a non-standard port is the weakest fellow in the bunch, but that does not mean the effect is zero. An extra 16 bit key length would obviously never mitigate a sshd vulnerability. An entirely different effect has been brought up by others already; a non-standard port is enough…
Like I said, nobody argues that it adds zero security, but that, for all the hassle it introduces, it adds way too little security to be worth it. 16 bits is nothing, and can be brute forced quickly.
Regarding port knocking: I’m assuming that most people don’t write their own port knocking software, but use something standard. The configuration of any port knocking scheme is equivalent to an additional separate key of length log2(number_of_possible_port_knocking_configurations). What is the effective “key length” of port knocking schemes?
Also remember that the “key” of port knocking, just like a non-standard port number, is transmitted in the clear, so anybody listening to the traffic can see it. (And if you assume that the attacker can’t listen to the traffic, why are you even using SSH instead of something simpler like telnet?)
Earlier quoted context omitted.
why nftables rather than iptables?
Im also curious about this, they use the same netfilter backend
So I made the choice to go ahead and focus on learning nft. It's been enjoyable.