41–45 of 45 posts
Those kubernetes controlplane endpoints are presumably secured with key-based authentication, right? Is it really worse than having an ssh server (with key-based authentication only) on port 22?
I know it's considered security through obscurity but it still makes sense for me to run sshd on a different port. And so it might be a good idea to use a different port than 6443 for the Kubernetes API. It doesn't make anything more secure per se but it helps evading automated scanners and reduces noise in the logs which helps in security monitoring.
Yeah, sometimes I think that quip/rule is unhelpful. The King of England's or US President's driving routes are known only to the convoy and staff who need to know for example, that massively raises the bar for someone hoping to make some kind of disruption to it, it reduces the number of threats/actors they need to worry about it, surely it's fair to say it increases security and that's why they do it. I think the l…
Something that can be trivially observed (changed port -> nmap, secret obfuscated code in your executable, behavior of your server) is not a secret.
That said, obscurity can provide defense-in-depth (i.e. protection against scanning the default port).
-- Changing the port can be useful for other reasons too, our pfsense's at work run ssh on 2222 simply because otherwise the logs are absolutely full of scanners getting banned (despite having password auth disabled).
Earlier quoted context omitted.
Yeah, sometimes I think that quip/rule is unhelpful. The King of England's or US President's driving routes are known only to the convoy and staff who need to know for example, that massively raises the bar for someone hoping to make some kind of disruption to it, it reduces the number of threats/actors they need to worry about it, surely it's fair to say it increases security and that's why they do it. I think the l…
The driving routes are not obscurity but actual secrets. Similarly, a private key is not obscurity but an actual secret. Something that can be trivially observed (changed port -> nmap, secret obfuscated code in your executable, behavior of your server) is not a secret. That said, obscurity can provide defense-in-depth (i.e. protection against scanning the default port). -- Changing the port can be useful for other re…
You can observe stuff like the way police motorcyclists (I think they call them 'outriders') speed ahead to the next junction, stop traffic, convoy passes through, rear motorcyclists meanwhile catch up to the front of the convoy and the ones holding traffic then adopt their position at the rear, swapping each junction. But there's no benefit to documenting/publicising that (and I'm sure there's nuance to it I haven't picked up on). It's probably also easier to get involved in the police and go on that advanced driving course or whatever and learn all about the techniques they use than it is to actually be assigned to that team - it's not super secret, but the more you keep hidden the harder you make it to be subversive.
Earlier quoted context omitted.
The tailscale k8s operator actually does auth as well as vpn.
that's exactly what i said. :)