Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I close SSH port 22 (and what I use instead)

michelebologna.net

Post reply on HN
Print view View original

81–90 of 106 posts

Re: I close SSH port 22 (and what I use instead)

#81

Post by jauntywundrkind »

jauntywundrkind wrote: post #3

Why not just use ssh as the knock protocol too? To a bespoke ssh server. Ssh to 7000, type "mellon", and ssh 22 opens up. No other software required, and you clearly already have ssh.

I threw an example together with Sol: Knoxbox https://github.com/rektide/knoxbox

It assumes systemd, which it uses to start sshd. It also restarts a systemd timer to shut sshd down in 5m. Ssh is set up (by defualt on Debian) to have KillMode=process, leaving the client instances alive, just killing the listen server.

I tend to agree with the top post. I've never felt that knock servers really deserve consideration. That said, the way that this knock server is so small, makes use of well known parts of the system as it is (systemd), is so low risk, and built around decent security building blocks (recursively) & not some ad-hoc protocol is kind of interesting and fun. This one is pretty easy to visualize.

Re: I close SSH port 22 (and what I use instead)

#83

Post by hn_throw2025 »

figmert wrote: post #24

The real solution is using something like Pangolin or Tailscale (or Headscale) for this. You can control access way better and you never have to expose ssh ever. Not even temporarily.

I agree with you.

I’m reading this thread and wondering if I’m missing something, why people are still talking about port knocking, port obfuscation, and fail2ban.

I use a cloud VPS. I ssh in via Tailscale. The cloud provider firewall blocks all incoming connections except traffic originating from Cloudflare IP ranges on port 443. My host plays dead to portscans. I check with nmap periodically. I have a break-glass backup terminal login option via my cloud provider dashboard (secured with MFA) in case Tailscale failed and needed investigation and repair.

This has worked well for me on AWS and Oracle Cloud. It’s quick and easy to set up. You need a timed service to refresh the ingress IP ranges, but any LLM could spit that out in a second.

Re: I close SSH port 22 (and what I use instead)

#84

Post by emj »

kazinator wrote: post #33
mmh0000 wrote: post #27

Earlier quoted context omitted.

This is a bad idea™. You should never have more than one UID 0 on a Unix system. This will violate most corporate security guidelines (STIG and CIS) * . And for good reason. A much better idea is to set up a non-root user and configure sudo correctly. * https://www.stigviewer.com/stigs/red_hat_enterprise_linux_9/...

I am not a corporation, so I don't need corporate guidelines. There isn't more than one UID 0. Only more than one password/shadow database entry pointing to it. (It might not be necessary; perhaps there is a way for OpenSSH to remap names, so that our example rotorooter is mapped to root by sshd itself.) > A much better idea is to set up a non-root user and configure sudo correctly. Even if so, the same principle app…

Using A as root username with Kj as password is good enough to not be bruteforced generally. People think too much about this.

Re: I close SSH port 22 (and what I use instead)

#85

Post by ozim »

tptacek wrote: post #55
fedpost wrote: post #4

Is this actually practically reducing the attack surface? We're replacing a battle hardened service with a random one that has the ability to manipulate the firewall rules.

No, it's not. The article itself is somewhat incoherent; for instance, if you're using key-only authentication (which: of course you are) fail2ban has literally no function (unless you think attackers are brute-forcing ECDH keys). The reality is that there are basically two ways to operate SSH: (1) You can, because OpenSSH is the significant remote service with the literal best track record of any remote service, jus…

Fail2ban, port knocking, magic packets, setting custom port are basically toys for wasting time. There are always people who have their website hosted on a VPS arguing back and forth about setting custom port ... yeah good luck setting those toys when you have dozens of servers and more than 4 administrators and actual work to be done.

SSH with key-key only or WireGuard/VPN on top are exactly what everyone uses for daily driving.

Re: I close SSH port 22 (and what I use instead)

#86

Post by ozim »

pak wrote: post #73
tptacek wrote: post #55

Earlier quoted context omitted.

No, it's not. The article itself is somewhat incoherent; for instance, if you're using key-only authentication (which: of course you are) fail2ban has literally no function (unless you think attackers are brute-forcing ECDH keys). The reality is that there are basically two ways to operate SSH: (1) You can, because OpenSSH is the significant remote service with the literal best track record of any remote service, jus…

OpenSSH has the best track record, but even it had a zero-day RCE (regreSSHion) in 2024. There are bound to be many more discovered as LLMs capable of doing so proliferate among those who don't report such things responsibly. Keeping port 22 open puts you first in line for such exploits, while keeping it behind another layer (whether it's WireGuard or firewall tricks) would buy time, if not keep attackers away entire…

Keeping port 22 open puts you first in line for such exploits

SSH RCE is a super expensive exploit - no one is firing that one while it still is a 0 day without having really important reason or juicy target.

Re: I close SSH port 22 (and what I use instead)

#89

Post by fragmede »

hn_throw2025 wrote: post #83
figmert wrote: post #24

The real solution is using something like Pangolin or Tailscale (or Headscale) for this. You can control access way better and you never have to expose ssh ever. Not even temporarily.

I agree with you. I’m reading this thread and wondering if I’m missing something, why people are still talking about port knocking, port obfuscation, and fail2ban. I use a cloud VPS. I ssh in via Tailscale. The cloud provider firewall blocks all incoming connections except traffic originating from Cloudflare IP ranges on port 443. My host plays dead to portscans. I check with nmap periodically. I have a break-glass b…

For those machines, yeah, but I have this fear, of being somewhere and my digital connection is broken. My phone/laptop/everything is stolen/lost/destroyed, and I have to break back in to my digital life. 2 factor authentication screws you if you don't have the second factor because you got mugged. So there might be a server out there that I can ssh into using a username, password, and a memorized IP address, that will get me recovery codes and into my password manager.

Re: I close SSH port 22 (and what I use instead)

#90

Post by ffsm8 »

kstrauser wrote: post #71
mmh0000 wrote: post #27

Earlier quoted context omitted.

This is a bad idea™. You should never have more than one UID 0 on a Unix system. This will violate most corporate security guidelines (STIG and CIS) * . And for good reason. A much better idea is to set up a non-root user and configure sudo correctly. * https://www.stigviewer.com/stigs/red_hat_enterprise_linux_9/...

Ah, yes, those BSD idiots with their root and toor accounts, clearly clueless about security concerns. I don’t recall ever seeing a security requirement not to have 2 root accounts. What you can’t have is multiple users sharing the same account. This is different.

in case anyone else is mildly curious (i didnt know that was a thing)

> The reason it exists is shell flexibility. Traditionally root's shell is kept as a statically-linked shell like /bin/csh or /bin/sh so that the superuser can always log in even in single-user mode or if dynamically-linked shells in /usr/local break. The toor account lets an admin have a UID 0 login with a fancier daily-driver shell (bash, zsh, etc.) without touching root's safe configuration.

Post reply on HN