Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Simple SSH Security

disknotifier.com

Post reply on HN
Print view View original

61–70 of 97 posts

Re: Simple SSH Security

#61

Post by croutonwagon »

adamzochowski wrote: post #33
jsd1982 wrote: post #27

Just a quick note on this excerpt: > Disallowing root login is also frequently recommended. I believe this has limited merit in our current landscape since 95% of the time, the user you log in with has sudo privileges. Then it adds no extra security. But you should really judge this for your own situation. Disallowing explicit `root` login makes it harder for attackers to guess the usernames which have sudo access, t…

The goal is to avoid password sharing. if 20 people have root password, and server supports root login, then you can't know which of the 20 people had their machines compromised. if 20 people each have to sudo, then you can trace which user was compromised.

Also, at least in Ubuntu, sudo commands are logged in syslog and are thus auditable.

That’s not necessarily the case if you su as root and run the same commands.

Re: Simple SSH Security

#62

Post by mhio »

aryhdrsfhzdf wrote: post #59
tadbit wrote: post #56

Earlier quoted context omitted.

> If you are logged in as a sudo user, provided allowing only an ssh key, can you can't do anything unless: > - you know the password This assumes one isn't using password-less sudo (NOPASSWD), which several distros do set by default and many users change to it for convenience.

What are some examples of these "several distros" that set it by default? Of the major ones I'm willing to use in production (Debian, Ubuntu, RHEL and derivs, SuSE, hesitantly Arch), none offer NOPASSWD sudo to users marked as administrative in each distro's normal way. (i.e. various group memberships) NOPASSWD is poor hygiene.

Amazon Linux

Re: Simple SSH Security

#63

Post by lousken »

slaymaker1907 wrote: post #17
lousken wrote: post #10

Earlier quoted context omitted.

Which ones aren't secure by default? When you install new OS like Debian those defaults will be correctly set (and depending on your organization, you may change some settings around to fit your needs). However, if you customized your config e.g. in debian 6 and updated to 11, you may wanna revisit those settings and change them

Not really SSH, but Kerberos on many distros allows extremely weak ciphers by default. And when I say weak, I mean these should have been disabled a decade ago. On Ubuntu 20.04 with the default setup, keytabs using DES are allowed...

Not sure about that, but from my understanding that's because with kerberos the encryption level doesn't matter as much because cracking DES from such a small amount of bytes still shouldn't be feasiable

Re: Simple SSH Security

#64

Post by egberts1 »

knorker wrote: post #54
xxpor wrote: post #51

Earlier quoted context omitted.

the vast vast majority of addresses aren't going to respond on port 22. Lets say there's 2,000,000 IPv4 addresses that are being used on the internet. If you scan 64,511 ports on each of them (65536-1024-1), that's still 129,022,000,000 connection attempts. Probably not worth it.

Doesn't help much when shodan has already portscanned everyone. I just searched for "ssh -port:22" and found many hits. But also yes. Switching port (or just blocking China) will vastly reduce SSH probes.

Don’t forget to block Brazil And Romania And Kazakhstan And …

Re: Simple SSH Security

#68

Post by remram »

adamzochowski wrote: post #33
jsd1982 wrote: post #27

Just a quick note on this excerpt: > Disallowing root login is also frequently recommended. I believe this has limited merit in our current landscape since 95% of the time, the user you log in with has sudo privileges. Then it adds no extra security. But you should really judge this for your own situation. Disallowing explicit `root` login makes it harder for attackers to guess the usernames which have sudo access, t…

The goal is to avoid password sharing. if 20 people have root password, and server supports root login, then you can't know which of the 20 people had their machines compromised. if 20 people each have to sudo, then you can trace which user was compromised.

Turning this on its head, about password sharing.

If 20 people have the root password, there is a single password that will allow your machine to be pwned.

If 20 people have 20 passwords and sudo access, then any of 20 passwords will allow your machine to be pwned.

You can't know which of the 20 people you're trusting to pick a password is reusing it.

Re: Simple SSH Security

#69

Post by miohtama »

adamzochowski wrote: post #33
jsd1982 wrote: post #27

Just a quick note on this excerpt: > Disallowing root login is also frequently recommended. I believe this has limited merit in our current landscape since 95% of the time, the user you log in with has sudo privileges. Then it adds no extra security. But you should really judge this for your own situation. Disallowing explicit `root` login makes it harder for attackers to guess the usernames which have sudo access, t…

The goal is to avoid password sharing. if 20 people have root password, and server supports root login, then you can't know which of the 20 people had their machines compromised. if 20 people each have to sudo, then you can trace which user was compromised.

A stronger solution to enable two-factor authentication, so that a machine compromise does not compromise SSH access.

Re: Simple SSH Security

#70

Post by gary_0 »

egberts1 wrote: post #64
knorker wrote: post #54

Earlier quoted context omitted.

Doesn't help much when shodan has already portscanned everyone. I just searched for "ssh -port:22" and found many hits. But also yes. Switching port (or just blocking China) will vastly reduce SSH probes.

Don’t forget to block Brazil And Romania And Kazakhstan And …

Last time I looked at the IPs spamming my websites, a lot of them were from Europe, surprisingly.
Post reply on HN