Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I close SSH port 22 (and what I use instead)

michelebologna.net

Post reply on HN
Print view View original

51–60 of 106 posts

Re: I close SSH port 22 (and what I use instead)

#51

Post by notpushkin »

jauntywundrkind wrote: post #3

Why not just use ssh as the knock protocol too? To a bespoke ssh server. Ssh to 7000, type "mellon", and ssh 22 opens up. No other software required, and you clearly already have ssh.

Why even type anything? Just ssh to 7000, and use the same public key to authenticate. The server responds with “You’re in”, opens up 22 and closes the connection. You then ssh normally.

This bespoke server should not advertise it in any special way though (generic OpenSSH banner), and can be used to also ban port scanners if they try to do something fishy.

fwknop is impossible to even scan for, though, so it’s a bit more robust in that sense.

Re: I close SSH port 22 (and what I use instead)

#52

Post by tptacek »

thayne wrote: post #43
teddyh wrote: post #28

Port knocking, and other bespoke middle layers in front of internet services, is stupid. It violates Kerckhoffs’s principle¹. If you want more secret bits which users need to know in order to access your system, increase your password lengths, or cryptographic key sizes. If you want to keep log sizes (or “noise”) manageable, adjust your logging levels. Anything added in front of your normal service also complicates a…

I think you are missing the point. It isn't about increasing the bits of security, it's about avoiding the flood of port scanners and the logs that produces. IPsec is way more complicated to set up than this (or other VPN solutions like Wireguard or OpenVPN for that matter), and doesn't even completely solve that problem, because your ipsec port is open. Although, admittedly, there are probably less bots looking for…

Just stop logging that stuff.

Re: I close SSH port 22 (and what I use instead)

#53

Post by s_ting765 »

If one is so worried about zero days in openssh, the more practical solution would be centered around these 2 questions:

1. "would you know if you got breached?" 2. "would you have any reaction time?"

A simple solution that answers this: https://github.com/64mb/ssh-login-alert-telegram/blob/master...

Re: I close SSH port 22 (and what I use instead)

#54

Post by therein »

imoverclocked wrote: post #45
kazinator wrote: post #33

Earlier quoted context omitted.

I am not a corporation, so I don't need corporate guidelines. There isn't more than one UID 0. Only more than one password/shadow database entry pointing to it. (It might not be necessary; perhaps there is a way for OpenSSH to remap names, so that our example rotorooter is mapped to root by sshd itself.) > A much better idea is to set up a non-root user and configure sudo correctly. Even if so, the same principle app…

> Whoever wrote that does not know WTF they are talking about ... or they know something you don't.

Quick, someone ask an LLM.

Re: I close SSH port 22 (and what I use instead)

#55

Post by tptacek »

fedpost wrote: post #4

Is this actually practically reducing the attack surface? We're replacing a battle hardened service with a random one that has the ability to manipulate the firewall rules.

No, it's not. The article itself is somewhat incoherent; for instance, if you're using key-only authentication (which: of course you are) fail2ban has literally no function (unless you think attackers are brute-forcing ECDH keys).

The reality is that there are basically two ways to operate SSH:

(1) You can, because OpenSSH is the significant remote service with the literal best track record of any remote service, just disable passwords and let SSH run in 22/tcp exposed to the Internet. Probably stop logging people scanning you; there's nothing you're going to do about it, so it's not real information.

(2) You can keep SSH behind WireGuard, an even simpler security protocol with an even better security story (though: OpenSSH is quite solid), which is designed to not to chat with counterparties that don't have keys, even to do negotiation.

Everything else is performative.

I'd incline towards option (2).

Re: I close SSH port 22 (and what I use instead)

#57

Post by vekntksijdhric »

thayne wrote: post #44
usernametaken29 wrote: post #19

I don’t know why this wasn’t mentioned before but why not use a Firewall. If you’re using a virtual box like Hetzner or Scaleway you can specify an ip or range at the router level. For all intents and purposes this removes public exposure. Scaleway also has a cheap VPN bridge. So you never need to connect via the public internet if you don’t want to… hardly gets more secure than that

If you are connecting from a residence or a mobile device (like a laptop), your ip address isn't fixed, so a firewall won't help.

this

Re: I close SSH port 22 (and what I use instead)

#58

Post by userbinator »

teddyh wrote: post #28

Port knocking, and other bespoke middle layers in front of internet services, is stupid. It violates Kerckhoffs’s principle¹. If you want more secret bits which users need to know in order to access your system, increase your password lengths, or cryptographic key sizes. If you want to keep log sizes (or “noise”) manageable, adjust your logging levels. Anything added in front of your normal service also complicates a…

It violates Kerckhoffs’s principle¹

Appeal to authority?

In the real world, it doesn't matter. Anything that makes the attacker's life harder is fair game. Stupid dogmatic sheep-like mindlessness only leads to "herd exploitability".

also complicates access

That's the whole point.

Re: I close SSH port 22 (and what I use instead)

#60

Post by tgv »

thayne wrote: post #44
usernametaken29 wrote: post #19

I don’t know why this wasn’t mentioned before but why not use a Firewall. If you’re using a virtual box like Hetzner or Scaleway you can specify an ip or range at the router level. For all intents and purposes this removes public exposure. Scaleway also has a cheap VPN bridge. So you never need to connect via the public internet if you don’t want to… hardly gets more secure than that

If you are connecting from a residence or a mobile device (like a laptop), your ip address isn't fixed, so a firewall won't help.

I use that strategy, as it's really simple, and I rarely have to change IP addresses. Many providers just hand out the same address every time, others as long as you keep your modem running. A colleague who regularly uses a mobile connection from abroad has a VPN with a fixed IP.

Password login is disabled. The only way to log in as root directly is via the terminal emulator on the coloc's admin page.

Post reply on HN