Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The OpenSSH Bug That Wasn't

bsdly.blogspot.com

Post reply on HN
Print view View original

1–10 of 92 posts

Re: The OpenSSH Bug That Wasn't

#2

Post by geerlingguy »

Key takeaway:

> And as several correspondents have reminded me already -- switching your sshd to keys only authentication will let you sleep better at night.

Even with fail2ban and limited retries, there's no excuse for using password-based authentication anymore. Use an SSH key, protect the key with a password, and turn off password login on all your servers.

Other than that, the main gist of this post is: on most platforms, the default settings for remote login already make brute-force login attempts annoying at best, and with fail2ban or something similar, it's a non-issue.

Re: The OpenSSH Bug That Wasn't

#3

Post by j_m_b »

I am curious as to what happens when this is done with an existent user? I feel like there would be different behaviors for timeouts when a non-existent username is used and when a wrong password is used for an existent username.

Re: The OpenSSH Bug That Wasn't

#4

Post by feld »

Thankfully my use of PAM is for 2FA with SSH when I don't have my key. So they wouldn't have been successful in pulling off a bruteforce anyway. But it's annoying that their attempts weren't being limited as it can waste resources...

Re: The OpenSSH Bug That Wasn't

#5

Post by feld »

j_m_b wrote: post #3

I am curious as to what happens when this is done with an existent user? I feel like there would be different behaviors for timeouts when a non-existent username is used and when a wrong password is used for an existent username.

No, the behavior needs to be identical in all failure cases or attackers can use the different feedback to learn valid usernames, etc

Re: The OpenSSH Bug That Wasn't

#6

Post by feld »

geerlingguy wrote: post #2

Key takeaway: > And as several correspondents have reminded me already -- switching your sshd to keys only authentication will let you sleep better at night. Even with fail2ban and limited retries, there's no excuse for using password-based authentication anymore. Use an SSH key, protect the key with a password, and turn off password login on all your servers. Other than that, the main gist of this post is: on most p…

Unless they can provide a username that crashes fail2ban via blowing up the regex parsing... and then they get all the free tries they want.

fail2ban/sshguard/etc are not infallible. Someone will find a way to break them.

Re: The OpenSSH Bug That Wasn't

#7

Post by jandrese »

geerlingguy wrote: post #2

Key takeaway: > And as several correspondents have reminded me already -- switching your sshd to keys only authentication will let you sleep better at night. Even with fail2ban and limited retries, there's no excuse for using password-based authentication anymore. Use an SSH key, protect the key with a password, and turn off password login on all your servers. Other than that, the main gist of this post is: on most p…

Then you're screwed when you need to log on to your server from some random machine that doesn't have your key installed.

Re: The OpenSSH Bug That Wasn't

#9

Post by cbhl »

jandrese wrote: post #7
geerlingguy wrote: post #2

Key takeaway: > And as several correspondents have reminded me already -- switching your sshd to keys only authentication will let you sleep better at night. Even with fail2ban and limited retries, there's no excuse for using password-based authentication anymore. Use an SSH key, protect the key with a password, and turn off password login on all your servers. Other than that, the main gist of this post is: on most p…

Then you're screwed when you need to log on to your server from some random machine that doesn't have your key installed.

You can mitigate this by having lots of machines with your key installed (at least two), in different physical locations.

Re: The OpenSSH Bug That Wasn't

#10

Post by heywire »

geerlingguy wrote: post #2

Key takeaway: > And as several correspondents have reminded me already -- switching your sshd to keys only authentication will let you sleep better at night. Even with fail2ban and limited retries, there's no excuse for using password-based authentication anymore. Use an SSH key, protect the key with a password, and turn off password login on all your servers. Other than that, the main gist of this post is: on most p…

I've always wanted to disable password based auth, but I am worried that if I need to connect to my machine in a pinch from some random device (wife's phone, borrowed machine from friend, work, etc), that I won't be able to connect. How do people get around this? Keep in mind that I'm talking about home machines and hobby VM instances, I do not manage any production servers or anything.
Post reply on HN