Why Not Use Port Knocking? (2012)
bsdly.blogspot.in
Why Not Use Port Knocking? (2012)
1–10 of 57 posts
Re: Why Not Use Port Knocking? (2012)
#2> Title: Why Not Use Port Knocking?
For me, the answer is simple: It violates Kerckhoffs’s principle¹. If you want more secret bits that users need to know in order to access your system, increase your password lengths. If you want to keep log sizes manageable, adjust your logging levels.
Re: Why Not Use Port Knocking? (2012)
#3> Title: Why Not Use Port Knocking? For me, the answer is simple: It violates Kerckhoffs’s principle¹. If you want more secret bits that users need to know in order to access your system, increase your password lengths . If you want to keep log sizes manageable, adjust your logging levels . 1) https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle
> If you want to keep log sizes manageable, adjust your logging levels.
Changing the port is a really good and simple fix. If you also drop packets to closed ports instead of rejecting them, you slow the scan down enough that only a targeted attack is likely to find your ssh port.
All that with no performance penalties, no cumbersome configuration, no experimental software, with one change to one config file. I say do it.
Re: Why Not Use Port Knocking? (2012)
#4Obligatory: I think port knocking is really silly and you shouldn't waste time with it. Disable root logins and password logins in SSH. If you have lots of hosts running SSH, collapse them down to one exposed SSH bastion host. Then get on with your life.
Re: Why Not Use Port Knocking? (2012)
#5> Title: Why Not Use Port Knocking? For me, the answer is simple: It violates Kerckhoffs’s principle¹. If you want more secret bits that users need to know in order to access your system, increase your password lengths . If you want to keep log sizes manageable, adjust your logging levels . 1) https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle
> If you want to keep log sizes manageable, adjust your logging levels. Changing the port is a really good and simple fix. If you also drop packets to closed ports instead of rejecting them, you slow the scan down enough that only a targeted attack is likely to find your ssh port. All that with no performance penalties, no cumbersome configuration, no experimental software, with one change to one config file. I say d…
I'm not a fan of changing the SSH port, but at least I get what that buys you.
Re: Why Not Use Port Knocking? (2012)
#6> Title: Why Not Use Port Knocking? For me, the answer is simple: It violates Kerckhoffs’s principle¹. If you want more secret bits that users need to know in order to access your system, increase your password lengths . If you want to keep log sizes manageable, adjust your logging levels . 1) https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle
The sequence of ports becomes a key. I don't think the principle is violated.
What I think is that you should disable password authentication anyway, and adding port knocking to a ssh server that doesn't accept passwords is equivalent to adding a thin wood plank to a 20" steel door with an state of the art lock.
Re: Why Not Use Port Knocking? (2012)
#7> Title: Why Not Use Port Knocking? For me, the answer is simple: It violates Kerckhoffs’s principle¹. If you want more secret bits that users need to know in order to access your system, increase your password lengths . If you want to keep log sizes manageable, adjust your logging levels . 1) https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle
> If you want to keep log sizes manageable, adjust your logging levels. Changing the port is a really good and simple fix. If you also drop packets to closed ports instead of rejecting them, you slow the scan down enough that only a targeted attack is likely to find your ssh port. All that with no performance penalties, no cumbersome configuration, no experimental software, with one change to one config file. I say d…
Changing port is the wrong solution to large log files. This seems obvious to me, but maybe I can put forward another drawback of changing the port number: It is confusing.
I mean, you could easily stop using the DNS and use raw IP addresses for everything - this should cut down on your attacks and maybe even spam, right? Nobody does this because it it insanely inconvenient, and ignores the solution to this inconvenience which DNS is. Standardized port numbers exist for many reasons - do not abandon them and create complexity for your fellows merely for your personal convenience.
Re: Why Not Use Port Knocking? (2012)
#8> Title: Why Not Use Port Knocking? For me, the answer is simple: It violates Kerckhoffs’s principle¹. If you want more secret bits that users need to know in order to access your system, increase your password lengths . If you want to keep log sizes manageable, adjust your logging levels . 1) https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle
The sequence of ports becomes a key. I don't think the principle is violated. What I think is that you should disable password authentication anyway, and adding port knocking to a ssh server that doesn't accept passwords is equivalent to adding a thin wood plank to a 20" steel door with an state of the art lock.
> The sequence of ports becomes a key.
Yes, I agree completely. Which is why it buys you nothing compared to simply increasing your password/key lengths with the equivalent number of bits. On the contrary, it introduces confusing complexity for oneself and one’s fellows. Maybe this is what unconscionable people call “Job security”?
> equivalent to adding a thin wood plank
It is less like a thin wooden plank and more like a hedge maze which all legitimate users also must traverse each time. And all the hedges are made of asbestos.
Re: Why Not Use Port Knocking? (2012)
#9I don't use port knocking because spiped is simpler and far more secure.
Re: Why Not Use Port Knocking? (2012)
#10Earlier quoted context omitted.
> If you want to keep log sizes manageable, adjust your logging levels. Changing the port is a really good and simple fix. If you also drop packets to closed ports instead of rejecting them, you slow the scan down enough that only a targeted attack is likely to find your ssh port. All that with no performance penalties, no cumbersome configuration, no experimental software, with one change to one config file. I say d…
Changing port is the wrong solution to large log files. This seems obvious to me, but maybe I can put forward another drawback of changing the port number: It is confusing . I mean, you could easily stop using the DNS and use raw IP addresses for everything - this should cut down on your attacks and maybe even spam, right? Nobody does this because it it insanely inconvenient, and ignores the solution to this inconven…
> I mean, you could easily stop using the DNS and use raw IP addresses for everything - this should cut down on your attacks and maybe even spam, right?
No, it wouldn't. But you do have a point. And most sysadmins don't let just anyone axfr their zone.
Like changing the port, it's not a security measure and it will inconvenience someone every once in a while. Still, I don't need to advertise every host I run.
Same with using a PO box or your provider's info for whois. It's not going to deter anyone determined but it cuts down on some casual annoyances.
EDIT: Also, setting the port
Host *.whatever.net
IdentityFile ~/.ssh/whatever
ServerAliveInterval 10
port 17022