Hm. Am I ready to build toshnet, a cloud of systems running tosh and a toshepherd, the masternode that stores the totp to find and manage them all? Mayhaps.
Tosh: Changing your SSH server's listen address every 30 seconds based on TOTP
21–30 of 200 posts
Re: Tosh: Changing your SSH server's listen address every 30 seconds based on TOTP
#22And all you have to do is trust that your client and server will always have synchronized clocks...
Your server has NTP. Your client likely, too, if it has enough network to connect to the server. If it does not use NTP, it's easy to set the time within the minute or so required manually.
Re: Tosh: Changing your SSH server's listen address every 30 seconds based on TOTP
#23That’s a super cool concept, but doesn’t this fall a bit under “security by obscurity”?
The "security by obscurity" one-liner is one of my favorite examples of the sort of black-and-white thinking that is harmful to software engineering. The truth is that playing defense is as much an exercise of technical design as it is economics. Yes - if someone finds the SSH port, they have a window of opportunity, and you will be owned if you are not properly securing your server through the normal channels. Howev…
> defense in depth helps you manage your defense with limited resources.
Indeed, but might there not better/cheaper ways to secure SSH?
Something that doesn't involve custom configuration that needs to be maintained.. like VPN to a jump-host... Or..?
Configuring and maintaining custom hacks is not cheap.
Re: Tosh: Changing your SSH server's listen address every 30 seconds based on TOTP
#24Earlier quoted context omitted.
The "security by obscurity" one-liner is one of my favorite examples of the sort of black-and-white thinking that is harmful to software engineering. The truth is that playing defense is as much an exercise of technical design as it is economics. Yes - if someone finds the SSH port, they have a window of opportunity, and you will be owned if you are not properly securing your server through the normal channels. Howev…
> defense in depth helps you manage your defense with limited resources. Indeed, but might there not better/cheaper ways to secure SSH? Something that doesn't involve custom configuration that needs to be maintained.. like VPN to a jump-host... Or..? Configuring and maintaining custom hacks is not cheap.
agreed - I would not deploy this as is, but the idea is interesting and I could imagine the concept being given some UX love in a different application
Re: Tosh: Changing your SSH server's listen address every 30 seconds based on TOTP
#25That’s a super cool concept, but doesn’t this fall a bit under “security by obscurity”?
The "security by obscurity" one-liner is one of my favorite examples of the sort of black-and-white thinking that is harmful to software engineering. The truth is that playing defense is as much an exercise of technical design as it is economics. Yes - if someone finds the SSH port, they have a window of opportunity, and you will be owned if you are not properly securing your server through the normal channels. Howev…
I like this analysis, but I'm having a hard time seeing the advantage over port-knocking, which could also be randomized using OTP and would never reveal the SSH server to a port scan.
Zero window seems better than a 30 second window.
Excellent points otherwise.
Re: Tosh: Changing your SSH server's listen address every 30 seconds based on TOTP
#26Really cool idea. If someone is interested further in the general concept it is called ”moving target defense.”
Compared to just deploying totp normally as a PAM module this is a horrible idea. Much harder to ratelimit, much cheaper for the attacker to bruteforce codes.
It’s neat for sure, but not a good defense.
Re: Tosh: Changing your SSH server's listen address every 30 seconds based on TOTP
#27That’s a super cool concept, but doesn’t this fall a bit under “security by obscurity”?
No, the TOTP is[0] a shared-secret bitstream (like a stream cypher), which provides new randomness per use (obscurity means it relies on the attacker not knowing how it works in the first place). This is very weak security, similar to a combination lock or PIN, and should not be used in place of proper SSH crypto, but it is actual security. (The point, IIUC, is to quickly exclude drive-by attackers, so that serious/targeted attacks are higher above the noise floor.)
0: assuming I'm not being overly charitable
Re: Tosh: Changing your SSH server's listen address every 30 seconds based on TOTP
#28And all you have to do is trust that your client and server will always have synchronized clocks...
From looking at the code, seems like it would be a pretty simple change to make the server accept several addresses, derived from the current time plus or minus a small number of 30-second intervals. That allows you to tolerate a small amount of clock skew, and if your clock is off by more than a minute or two, you should probably fix it anyway.
Re: Tosh: Changing your SSH server's listen address every 30 seconds based on TOTP
#29Make sure your time servers are configured correctly. My department had several Silicon Graphics workstations. Running IRIX, they machines determine amongst themselves which has the most accurate time and they vote that one as the Timemaster. Any new machines added would take their time from the Timemaster.
The oldest machine was Timemaster and 8.5 minutes off. Took me week to figure out why my brand workstation had bad time. Fun times
Re: Tosh: Changing your SSH server's listen address every 30 seconds based on TOTP
#30This makes me wonder if you could take this further and make the connection protocol dance across a variety of ports as part of the initial handshake.