I always wonder if something like Teleport is going to catch on to change this conversation a little bit.
Simple SSH Security
21–30 of 97 posts
Re: Simple SSH Security
#22I always wonder if something like Teleport is going to catch on to change this conversation a little bit. https://goteleport.com/
I use https://tailscale.com, Teleport looks similar? Or do you prefer one over the other?
Re: Simple SSH Security
#23Doesn't mention passwording the keys or anything like TOTP, which isn't all that hard to setup (albeit a bit more complex for a simple guide). Nor any reactive address blocking
Re: Simple SSH Security
#24See also: https://bettercrypto.org/#_openssh https://www.debian.org/doc/manuals/securing-debian-manual/se...
I have been asking this of colleagues informally for decades now, but I will do it again: why is it that, if the majority of best practices for security are identical (ie "disable these settings asap"), are the default settings the way they are? And what would it take to change them to be secure by default?
The defaults support the largest number of client SSH implementations. If you're doing a de novo SSH implementation, you can almost certainly just support the newest clients, and thus get a better config.
Re: Simple SSH Security
#25These howtos involving cryptography should generally be ignored unless you actually understand the issues fairly well. The default configuration gets a lot of scrutiny. The stuff from "Big Bobs Super Secure" configuration howto mostly comes from the same sort of article. The ideas from these things take on a life and truth of their own after they circulate around a few times.
Re: Simple SSH Security
#26I always wonder if something like Teleport is going to catch on to change this conversation a little bit. https://goteleport.com/
When did they stop being called Gravitational?
Re: Simple SSH Security
#27Just a quick note on this excerpt:
> Disallowing root login is also frequently recommended. I believe this has limited merit in our current landscape since 95% of the time, the user you log in with has sudo privileges. Then it adds no extra security. But you should really judge this for your own situation.
Disallowing explicit `root` login makes it harder for attackers to guess the usernames which have sudo access, thus I'd say it decreases the attack surface area. Yes, sudo gives them the same level of access as root but the path to get there from an attacker's perspective is not the same.
Re: Simple SSH Security
#28File /etc/ssh/moduli is part of openssh. So shouldn't the distros push out an update.
Re: Simple SSH Security
#29I've always just used this guide:
https://sshaudit.com/hardening_guides.html#rhel8
Any reason why I shouldn't?
Re: Simple SSH Security
#30I always wonder if something like Teleport is going to catch on to change this conversation a little bit. https://goteleport.com/
When did they stop being called Gravitational?
Roughly a year ago (November 2020):