171–180 of 192 posts
Earlier quoted context omitted.
So that means you can't SSH into your remote machine from an arbitrary connection? What do you do when you're traveling?
You use a VPN and then connect to SSH
IE, Why is it important that your SSH port only be connected to by known IPs, but your VPN port is OK to be connected to from anywhere?
Ouch, camouflage on a tank is a good analogy. Nice response post. In addition to, as the author encourages, being "weary of the 'by obscurity'" argument (as I'm sure we all already are), I would also advocate being wary of it :)
No it isn't. Every server runs SSH, so this is more like there's a field, and you know there's a tank in the field, but you can't see it. The next thing you do then is take out your standard radar device which scans the field, and pinpoints exactly where the tank is in 3 seconds, and then you aim your tank buster at that spot and fire.
Anyone use Dome9? ( http://dome9.com ) they close all of your ports and open them on demand via chrome extension or mobile app for when you want to use SSH.
Is there a way to increase the privileged port range from 1024 in linux? If it's set to a high enough number, say 1024*1024, that would solve both problems (we could use a large port number for ssh and not allow non-root users to hijack the port).
Earlier quoted context omitted.
I agree but I think TFA should clarify that it's probably a good idea to run sshd on a non-standard port . While other posters are right to point out that server certificate should make sure nobody can truly hijack your sshd there's no point in taking the risk unless for some reason all privileged ports are in use. Not to mention that ssh's key model is a bit broken since there's not built-in way to distribute the ke…
They just need to scan once to find the port speaking SSH, then brute force as usual. If you want actual more protection run a bogus SSH (with no login allowed) on 22 and a thousand unused ports... then they have to try them all or guess which port is actually able to log in.
You are right that it doesn't protect from a targeted attack. In my experience (10 years as a sysadmin and dev), I've never had a targeted attack -- all the attempts against my machines are drive by.
Having port 22 open can end my IPs on a list of "let's try to break later".
It's not close to a complete solution, but I find it beneficial.
Earlier quoted context omitted.
And now you have another exploitable venue, the log parser of fail2ban ;). Personally, I trust netfilter/iptables' rate limiting more.
Even better yet is pam_abl. If any IP or user fails authentication faster than a configured rate pam_abl will block logging into that user or any authentication attempts coming from the same IP address and it's all nicely tied into PAM so you don't have to worry about yet another fail2ban vulnerability or someone spoofing some important IP address and tricking your server into blocking it.
Earlier quoted context omitted.
Port scanning is generally automated (edit: and scans all ports, not just the handful you listed), so it doesn't actually matter which port you pick as long as it's not 22. Port scanners like nmap are widely available, so the time to actually figure out which port is running SSH is quite short in practice. Basically, there are two classes of people: 1. Those who use port scanners. 2. Those who do not. If you are bein…
those numbers don't look good at when you take a look at what those two classes of people are doing. ie. 1. is targeting you specifically, 2. is bot targeting everyone when presented with two options, thinking of those options as 50:50 is natural, but it's really more like 0.0000001:99.9999999
As a consequence, the chance of one of those 0.999999 bots invading your computer is zero, the chance of one of the 0.000001 doing the same is non-zero.
Earlier quoted context omitted.
Port scanning is generally automated (edit: and scans all ports, not just the handful you listed), so it doesn't actually matter which port you pick as long as it's not 22. Port scanners like nmap are widely available, so the time to actually figure out which port is running SSH is quite short in practice. Basically, there are two classes of people: 1. Those who use port scanners. 2. Those who do not. If you are bein…
Who is going to bother with a portscanner when there are plenty of targets on port 22. The targets on other ports are more likely to have been set to use keys, or at least have better passwords.
Earlier quoted context omitted.
Why would I use a VPN when I have SSH? IE, why do you think that a VPN is somehow more secure than an SSH connection?
VPN is not mutually exclusive with using SSH. What he's saying is that people should firewall their SSH ports to only allow access from trusted IPs, and VPN's make that easier to do.
You can get in a network by VPN or SSH. Yes, after that you can also log into a computer by SSH, but the question remains - why access the network by VPN instead of SSH?