Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bastion hosts

pandastrike.com

Post reply on HN
Print view View original

31–40 of 59 posts

Re: Bastion hosts

#31

Post by tptacek »

arde wrote: post #27
tptacek wrote: post #12

Earlier quoted context omitted.

I don't care what you call it; the point is, it doesn't save you from anything that the correct SSH configuration doesn't already protect you from. If you really believe that OpenSSH is too scary to expose to the Internet for fear of memory corruption flaws, don't stop at a half-measure like "port authentication". After all: once you "authenticate" the port, the attacker can simply hijack your TCP connection to trigg…

Yes, an AES-CTR transformation would be more secure than any port knocking variety such as SPA, at the cost of being more complicated. But the point in port knocking is not its intrinsic security, which is not worth to talk about: its point is actually the obscurity it adds to some other secure access method such as SSH, and its ease of implementation and usage. With it you get much shorter and less noisy logs to mon…

You're not thinking the threat model through. If you're not concerned about the kinds of serious, dedicated attackers who have OpenSSH zero-day, you're fine leaving properly-configured OpenSSH exposed. If you are concerned about those attackers, port knocking is barely a speed bump.

I also dispute that a plugboard proxy is "more complicated" than "cryptographic port knocking".

Re: Bastion hosts

#32

Post by voltagex_ »

cdubz wrote: post #14
neohaven wrote: post #3

Direct quote from the page at the other end of this link : "You appear to be using a browser that may not be able to display our site correctly. Generally, this is beause it's an older browser that doesn't support a lot of the newer, awesome features in open Web standards. Rather than provide an untested and possibly subpar experience of our site, may we suggest downloading one of these fine browsers? (We think you'l…

TBH, > 6 months old is hopelessly outdated. Welcome to the future, grampa.

Some of us are using browsers imposed upon us by $EMPLOYER, and may not be able to update of our own volition.

Re: Bastion hosts

#33

Post by arde »

the_french wrote: post #17
kev009 wrote: post #16

This article goes from mediocre to bad when it starts advocating security by obscurity.

Security by obscurity is perfectly fine when it's part of a layered approach. It will help keep attackers from learning the details of your architecture and will also stop skiddies in their tracks.

This. Obscurity has too much bad press. It's not to be depended on, but it can be a useful addition sometimes.

Re: Bastion hosts

#34

Post by arde »

philjr wrote: post #24
rsync wrote: post #23

Earlier quoted context omitted.

I've been doing this sysadmin thing for a long, long time, and have built some large, high profile platforms,[1][2] and I can tell you that few things have made me happier than port knocking. Yes, it is a password with a tiny number of "bits". But nobody suggested using only port knocking, so that's not significant. Yes, if my attacker is sharing the exact same NAT'd IP as me then they have a window to attack ... my…

just run ssh on a non-standard port and you get the same benefits

That is equivalent to limiting SPA to a 16-bit password.

Re: Bastion hosts

#35

Post by arde »

peterwwillis wrote: post #28
rsync wrote: post #23

Earlier quoted context omitted.

I've been doing this sysadmin thing for a long, long time, and have built some large, high profile platforms,[1][2] and I can tell you that few things have made me happier than port knocking. Yes, it is a password with a tiny number of "bits". But nobody suggested using only port knocking, so that's not significant. Yes, if my attacker is sharing the exact same NAT'd IP as me then they have a window to attack ... my…

Mr. Sysadmin, I have four questions: 1. When was the last time your sshd was hit with a 0day? 2. Why aren't you running grsec to prevent buffer overflows (amongst other things) ? 3. Wouldn't it be easier to DOS your host with excess traffic (like all modern DDOS attacks), rather than find a remote-code-execution buffer overflow 0day and use it solely to starve resources on a bastion host? 4. Why don't you use a VPN?…

Regarding item 4, a VPN solution is considerably more complex and error prone than port knocking plus SSH. What do you do if/when your VPN service fails? I think you would usually have a VPN service AND a port knocked SSH backdoor.

Re: Bastion hosts

#36

Post by ryan-c »

cdubz wrote: post #14
neohaven wrote: post #3

Direct quote from the page at the other end of this link : "You appear to be using a browser that may not be able to display our site correctly. Generally, this is beause it's an older browser that doesn't support a lot of the newer, awesome features in open Web standards. Rather than provide an untested and possibly subpar experience of our site, may we suggest downloading one of these fine browsers? (We think you'l…

TBH, > 6 months old is hopelessly outdated. Welcome to the future, grampa.

I think Firefox 24 is still supported for a few more weeks, as it is a "long term" release.

Re: Bastion hosts

#37

Post by vacri »

cdubz wrote: post #14
neohaven wrote: post #3

Direct quote from the page at the other end of this link : "You appear to be using a browser that may not be able to display our site correctly. Generally, this is beause it's an older browser that doesn't support a lot of the newer, awesome features in open Web standards. Rather than provide an untested and possibly subpar experience of our site, may we suggest downloading one of these fine browsers? (We think you'l…

TBH, > 6 months old is hopelessly outdated. Welcome to the future, grampa.

The point of those LTS browsers is so that an employer doesn't have to watch for UI changes in their browser every 6 weeks, and then retrain all their staff when the browser moves things around or makes things look different.

Re: Bastion hosts

#38

Post by neohaven »

tedunangst wrote: post #7
neohaven wrote: post #3

Direct quote from the page at the other end of this link : "You appear to be using a browser that may not be able to display our site correctly. Generally, this is beause it's an older browser that doesn't support a lot of the newer, awesome features in open Web standards. Rather than provide an untested and possibly subpar experience of our site, may we suggest downloading one of these fine browsers? (We think you'l…

Since it's only a plaintext page, you can read it with curl. Or you could, except the server is broken and sends back gzipped data even if the client doesn't request it. curl https://www.pandastrike.com/posts/20141113-bastion-hosts | gunzip | more

I shouldn't have to grab a page curl to see a website. A disclaimer of "Hey we notice $X is your browser, maybe switch to those?" with a "No thanks, I'll deal with it" option on some modal JS dialog.

Re: Bastion hosts

#39

Post by moe »

jpgvm wrote: post #20
phil21 wrote: post #10

Earlier quoted context omitted.

> A better idea, if you're in AWS, is to use a VPC and just VPN into your environment; Is it though? Is having your (and your co-workers) desktops/laptops/and possibly more directly able to access production servers at a packet level a good idea? I would posit that it is not. A bastion host can be used to lock down more than firewalls, and reduces the attack surface living on your network considerably. > VPN terminat…

Bastion hosts are generally a bad idea. There is not a single implementation of a bastion host that doesn't have significant security holes. This is doubly true if you want to do proper group based access control. Most notable of these issues is the nature of either needing SSH agent forwarding enabled or storing a copy of the private keys on the bastion host (please don't do that). There are ofcourse ways of dealing…

Bastion hosts are generally a bad idea.

It's fundamentally much better to just harden every system

You must be one of those people that don't make mistakes and only use bug-free software across their entire deployment.

For the rest of us, DMZ's and bastion hosts are the only way to limit our attack surface to something that can be realistically managed.

Re: Bastion hosts

#40

Post by sophacles »

cthalupa wrote: post #15
akerl_ wrote: post #13

Earlier quoted context omitted.

It's worth noting that single packet auth is distinct from port knocking. fwknop isn't relying on "secret" port combinations: it's using GPG to sign/encrypt requests.

It's not meaningfully different - most of the same flaws still apply. Say you have a bad actor behind the same NAT'ed IP. Good User A signs their SPA, and the firewall opens up for 30 seconds... during which Malicious User B has access. What real advantage are you gaining vs. just having restricted firewall rules in the first place? Lowering the window of time an attacker has access? If you're not using password auth…

The advantage over vanilla restrictive firewalls is ability to come from many different IPs without cluttering logs.

In an enterprise setting, this is probably not helpful. At home or for private servers, this is a nice feature.

(Also at home, it helps reduce stupid ISP imposed rules on not hosting ssh... their scanners just assume "no server here" but I can still get to my home network)

Post reply on HN