Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FreeBSD SSH Hardening

gist.github.com

Post reply on HN
Print view View original

51–60 of 121 posts

Re: FreeBSD SSH Hardening

#51

Post by mercora »

beermonster wrote: post #38

Not everyone knows that you can use MFA with SSH. I’ve successfully used Google authenticator via PAM[1] and YubiKey[2]. You can also setup SSH certificate authorities instead of using self-signed ones [3] [1] https://wiki.archlinux.org/title/Google_Authenticator [2] https://developers.yubico.com/SSH/ [3] https://jameshfisher.com/2018/03/16/how-to-create-an-ssh-cer...

i did not notice until skimming this arch wiki page that it is now possible to have both MFA or pam auth in general and key auth both required at the same time to authenticate, great!

Re: FreeBSD SSH Hardening

#52

Post by beermonster »

akerl_ wrote: post #45
beermonster wrote: post #38

Not everyone knows that you can use MFA with SSH. I’ve successfully used Google authenticator via PAM[1] and YubiKey[2]. You can also setup SSH certificate authorities instead of using self-signed ones [3] [1] https://wiki.archlinux.org/title/Google_Authenticator [2] https://developers.yubico.com/SSH/ [3] https://jameshfisher.com/2018/03/16/how-to-create-an-ssh-cer...

Jumping on the bandwagon here, SSH also now supports FIDO/U2F. This allows for hardware security keys like Yubikeys to be used directly for auth, rather than via TOTP/HOTP codes. https://www.openssh.com/txt/release-8.2

Oh neat! Didn’t know that :)

Re: FreeBSD SSH Hardening

#53

Post by beermonster »

mercora wrote: post #51
beermonster wrote: post #38

Not everyone knows that you can use MFA with SSH. I’ve successfully used Google authenticator via PAM[1] and YubiKey[2]. You can also setup SSH certificate authorities instead of using self-signed ones [3] [1] https://wiki.archlinux.org/title/Google_Authenticator [2] https://developers.yubico.com/SSH/ [3] https://jameshfisher.com/2018/03/16/how-to-create-an-ssh-cer...

i did not notice until skimming this arch wiki page that it is now possible to have both MFA or pam auth in general and key auth both required at the same time to authenticate, great!

I made a mistake once setting this up and I managed to have password AND key and MFA. This was a misconfiguration but might be useful for some use-cases. So it’s good to know it’s not either/or.

Re: FreeBSD SSH Hardening

#55

Post by beermonster »

rsync wrote: post #48
beermonster wrote: post #35

When using the SSH protocol for running automated remote commands you can improve security using forced command[1] within your authorized_keys file. [1] https://ctrlnotes.com/restrict-a-user-to-ssh-forced-command/...

... and you can also restrict by IP address in authorized_keys ...

Ah yes, before your key type specifier i.e. at the very beginning use something like :

from="192.168.1.0/24"

Re: FreeBSD SSH Hardening

#56

Post by amarshall »

cpach wrote: post #33
tiffanyh wrote: post #30

Earlier quoted context omitted.

Is Spiped similar in-concept to a VPN?

Yes. When spiped was released (2011) there were no really good VPN solutions out there. Now there is WireGuard, but it wasn’t launched until 2016.

OpenVPN may have its issues (complicated setup vs. e.g. Wireguard, but not vs. e.g. IPsec), but I wouldn’t call it “not good” and it predates spiped by a decade.

Re: FreeBSD SSH Hardening

#57

Post by cpach »

amarshall wrote: post #56
cpach wrote: post #33

Earlier quoted context omitted.

Yes. When spiped was released (2011) there were no really good VPN solutions out there. Now there is WireGuard, but it wasn’t launched until 2016.

OpenVPN may have its issues (complicated setup vs. e.g. Wireguard, but not vs. e.g. IPsec), but I wouldn’t call it “not good” and it predates spiped by a decade.

Ok. I don’t agree there. What I’ve heard from security experts is that WireGuard is vastly superior to OpenVPN.

Addendum: OpenVPN was released in 2001 and there where lots of cryptography-related systems from that era that certainly didn’t age well – IMO OpenVPN is one of those examples.

Re: FreeBSD SSH Hardening

#58

Post by akerl_ »

shapefrog wrote: post #54
lou1306 wrote: post #8

Relevant: If your SSH server is public, you can give its address to https://sshcheck.com/ and it will report any weak spots in your config.

I like it a lot ... I just dont know what to do about all my 'weak' results.

Generally they’re going to be for legacy ciphers/MACs/etc.

If you don’t need them, you can turn them off. If you’re the only one accessing your servers, you can honestly just pick a single option for each based on the highest security option that’s supported by all your client devices.

https://infosec.mozilla.org/guidelines/openssh.html is a good starting point. The lists of available options are sorted from left -> right, most optimal -> least.

Re: FreeBSD SSH Hardening

#59

Post by kd913 »

RealStickman_ wrote: post #43
kd913 wrote: post #19

Earlier quoted context omitted.

I think there are better approaches than this. 1) Setup a VPN via wireguard and only expose that random udp port. That way only a single UDP port is exposed and port-scans become infeasible. 2) Setup 2fa via libpam-google

What would you do if your Wireguard tunnel dies? That's the one thing that's prevented me from actually doing this.

I have 5 locations running effectively independent VPNs, each hub connected to each other for redundancy if a VPN falls over.

i.e. Each hub has 1 VPN in, or is connecting 4 ways out.

If the port forwarding or something fails inbound, then I can connect via another VPN and try and debug/diagnose what is wrong.

If all VPNs are reporting down, then I know the pi/internet is completely down. It will either restart connectivity, but I have someone there who can plug/unplug/restore the system if necessary. The same kind of problem would occur if ssh falls over or wireguard.

Re: FreeBSD SSH Hardening

#60

Post by waynesonfire »

toast0 wrote: post #7
tester756 wrote: post #2

I always heard that FreeBSD has unparalleled networking Does it mean that it'd be worth picking FreeBSD over Linux for my C# crud app if it had to handle a lot of requests/sec? (let's ignore db for the moment)

As with all things, you would really need to benchmark the system, preferably with real load, both ways to know for sure. But that takes a lot of time, especially if you're going to put in the time to tweak both systems. People can do amazing stuff with enough time in both FreeBSD and Linux. I honestly think most server applications wouldn't be held back by either OS. You need your application to be really lightweigh…

> but what I like most about FreeBSD is the lack of churn

I agree completely. As I mature in this field this becomes an ever important characteristic of the technology I adopt. Erlang also shares this property.

Post reply on HN