I close SSH port 22 (and what I use instead)
michelebologna.net
I close SSH port 22 (and what I use instead)
1–10 of 106 posts
Re: I close SSH port 22 (and what I use instead)
#2I would go with something like:
seed=`date +%s%N`; ( echo "secretknock-20260811|$seed"|sha512sum ; echo $seed ) | xargs nc -u 192.168.1.1
On other hand if threat vector includes network monitor with ability to replay i would use wireguard to wrap ssh traffic.
Re: I close SSH port 22 (and what I use instead)
#3Why not just use ssh as the knock protocol too? To a bespoke ssh server. Ssh to 7000, type "mellon", and ssh 22 opens up. No other software required, and you clearly already have ssh.
Re: I close SSH port 22 (and what I use instead)
#4Is this actually practically reducing the attack surface? We're replacing a battle hardened service with a random one that has the ability to manipulate the firewall rules.
Re: I close SSH port 22 (and what I use instead)
#5> and why it is not enough on its own
Nothing is good enough on its own.
Geoblocking, fail2ban, port obscurity, SSH keys, limiting logins to specific usernames, not using your public internet nickname, putting things behind CloudFlare tunnels or WireGuard, wildcard DNS obscurity, 2FA... There are many options.
Defense in depth is the only way to put services on the internet.
Re: I close SSH port 22 (and what I use instead)
#6This is a lot of complexity compared to just not having ssh open to the world (on whatever port you choose to use).
Restrict it to the networks where authorized users will be connecting.
Re: I close SSH port 22 (and what I use instead)
#7Is this actually practically reducing the attack surface? We're replacing a battle hardened service with a random one that has the ability to manipulate the firewall rules.
A sensible observation. In theory, the entire codebase for a simple HMAC knock knock ought to be tiny and easy to harden with multiple rounds of human and LLM review.
The goal should be to have your complex layers sitting in front of simpler, easier-to-review lines of defence. Once you get to something like an open connection to ssh, the potential attack surface would be orders of magnitude larger, even though it’s more mature and closely scrutinised.
Re: I close SSH port 22 (and what I use instead)
#8Stacking is cool, but what happened to also having a firewall in front of it?!
Re: I close SSH port 22 (and what I use instead)
#9> and why it is not enough on its own Nothing is good enough on its own. Geoblocking, fail2ban, port obscurity, SSH keys, limiting logins to specific usernames, not using your public internet nickname, putting things behind CloudFlare tunnels or WireGuard, wildcard DNS obscurity, 2FA... There are many options. Defense in depth is the only way to put services on the internet.
> Geoblocking, fail2ban
I use both on one port 22 host. Not much actually touches the server: maybe 5 hosts a day get banned. Meanwhile, China and the Netherlands are forever getting blocked and logged by geoblocking.
I check the 24h log window by country most business days. Some days China leads, other days the Netherlands pulls ahead. Almost never are any other countries close to those two.
Re: I close SSH port 22 (and what I use instead)
#10Glad to see fwknop mentioned. Back when the idea of port knocking emerged, there was a lot of criticism about it. Then this came out, and not many seemed to notice.
This was before WireGuard and Tailscale, so the main option for remote access was IPsec or OpenVPN, which are both more complicated than most people want to deal with.