Why Not Use Port Knocking? (2012)

Post by rnovak » Wed, Jun 03, 2015, 12:33 AM UTC

getsat wrote: post #7

rnovak wrote: post #6

Earlier quoted context omitted.

oh yeah, sorry, I didn't mean to make it out like I was complaining. I log all blocked traffic, so I get data related to ports other than just SSH. I was more lamenting that people even want to attack my VPS, as there's really nothing interesting about it.

It's not people, though. It's bots! While changing the ssh port adds a comically small amount of security (if any), it isolates you from 99.99% of automated attacks and keeps those logs clean, so I'd recommend it for everyone. Just remember that the port argument to `scp` is -P and not -p like it is for `ssh`. :p

Post by cmdrfred » Wed, Jun 03, 2015, 3:17 AM UTC

getsat wrote: post #5

rnovak wrote: post #3

Earlier quoted context omitted.

From what I could gather, is that because most port knocking examples use 3 port sequences, that boils down to 3 Unicode characters. Likening that to a password, I think he's saying putting a layer of security in front of SSH, protected only by a 3 character password, is not a great idea, and that he's seen slow brute force attacks that seem to be able to overcome such things. (Edit: For what it's worth, when I tried…

Changing the port to something other than the default (even to something obvious like 22222) will get rid of all the log spam. You could also use something like fail2ban, but changing the port is much simpler.

Post by x0x0 » Wed, Jun 03, 2015, 3:24 AM UTC

kazinator wrote: post #12

I stopped using port knocking simply because it made remote access a hassle. Scanning logs for intrusions and banning offending IP's deals approximately the same locus of issues that port knocking does. Now if you absolutely must have deathly silence in your SSH logs, then only port knocking will do.

Post by kazinator » Wed, Jun 03, 2015, 4:51 AM UTC

x0x0 wrote: post #15

kazinator wrote: post #12

I stopped using port knocking simply because it made remote access a hassle. Scanning logs for intrusions and banning offending IP's deals approximately the same locus of issues that port knocking does. Now if you absolutely must have deathly silence in your SSH logs, then only port knocking will do.

I use iptables to ratelimit ssh connections to 4 per 300 seconds per ip. I feel like that plus using a key provides a reasonable level of security while not being a pita. Open question -- is there any reason this is a bad idea?

Post by kazinator » Wed, Jun 03, 2015, 1:44 PM UTC

x0x0 wrote: post #18

kazinator wrote: post #17

Earlier quoted context omitted.

This is all connections, even if every connection attempt from a given IP succeeds? It's not a bad policy overall, but of course it interferes with a legitimate use: a script which rapidly executes numerous SSH commands.

yes, all connections things like scp and rsync recycle connections across files though, so it hasn't been a problem in practice; ansible does too if you use openssh instead of paramiko ps -- if someone knows iptables well, and is willing to share a similar script for failed connections, I would be grateful! But doing this across all ssh connections was easy enough that even I managed to get it working.

  while whatever ; do
    # hit host with a ssh command numerous times in loop
    ssh user@host command ...
    ...
  done