Tosh: Changing your SSH server's listen address every 30 seconds based on TOTP
1–10 of 200 posts
Re: Tosh: Changing your SSH server's listen address every 30 seconds based on TOTP
#2Really cool idea. If someone is interested further in the general concept it is called ”moving target defense.”
Re: Tosh: Changing your SSH server's listen address every 30 seconds based on TOTP
#3That’s a super cool concept, but doesn’t this fall a bit under “security by obscurity”?
Re: Tosh: Changing your SSH server's listen address every 30 seconds based on TOTP
#4That’s a super cool concept, but doesn’t this fall a bit under “security by obscurity”?
I think the time aspect makes it OK, otherwise TOTP itself should be abandoned due to the same principle. (SSH still has password)
Re: Tosh: Changing your SSH server's listen address every 30 seconds based on TOTP
#5That’s a super cool concept, but doesn’t this fall a bit under “security by obscurity”?
It's another layer of security. There have been exploits of OpenSSH in past so this may be prudent.
Re: Tosh: Changing your SSH server's listen address every 30 seconds based on TOTP
#6Anyone done TOTP port-knocking to open an SSH listen port with just the originator white-listed for a short window?
Re: Tosh: Changing your SSH server's listen address every 30 seconds based on TOTP
#7That’s a super cool concept, but doesn’t this fall a bit under “security by obscurity”?
Yes, but that's only bad if it's your only security.
Re: Tosh: Changing your SSH server's listen address every 30 seconds based on TOTP
#8That’s a super cool concept, but doesn’t this fall a bit under “security by obscurity”?
I don't know why people knock on "security by obscurity" in general, it's a great defense for many threat models that an average individual would fall under.
A lot of credential stealing viruses just look for specific folders or file names for examples, some vulnerability scanners look for specific ports, etc ...
Re: Tosh: Changing your SSH server's listen address every 30 seconds based on TOTP
#9That’s a super cool concept, but doesn’t this fall a bit under “security by obscurity”?
Yes, but that's only bad if it's your only security.
Layering has additional costs, like requiring additional client configuration and software and (in this case) only working over IPv6.
The number one step any public‐facing SSH server should take is to switch from password auth to keys only. Anyone who’s still concerned can put it behind a WireGuard VPN. Layers typically added beyond that (like changing port, etc.) don’t even register on the security scale, so to speak.
The tweet that inspired the post mentioned port knocking which has always been rather ridiculous given those alternatives.
Re: Tosh: Changing your SSH server's listen address every 30 seconds based on TOTP
#10Super koel!