Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #175525

Re: ssh doesn't work.

Show all headers | View raw

On Wed, Dec 07, 2016 at 01:49:34PM -0500, Greg Wooledge wrote:
> On Wed, Dec 07, 2016 at 01:23:23PM -0500, Henning Follmann wrote:
> > Also changing the port to a nonstandard port is not a safety measure. Not a
> > reasonable at least. Unless there is some sane reason (like the network
> > operator prevents using port 22) keep it!
> 
> I disagree with this.  Changing the port at least decreases the number
> of brute force attacks against you, which saves resources (bandwidth, CPU)
> that are otherwise wasted by the attackers.
> 
This is security by obscurity, which has some serious issues.
First it hides obvious issues. If you see high traffic on port 9999 noone
in the NOC knows what that is. If it is on port 22 they know it's ssh.

Also have a sensible plan in place (and the documentation with it).
So if I have admins in the US and in Germany, I only let ip from that
origin connect to port 22.

And also IDS (e.g. fail2ban) help you cutting those waste cpu cycles down.

And the best part about this, any issue will be obvious. And  obscurity
is the enemy of security.


> I understand that you mean "it will not stop a dedicated professional
> attacker who really, really wants to get into your computer".  And that's
> true.  But it does help against the random script kiddies and attacks of
> opportunity.
> 

And to protect against the "professionals" allow only pk authentication
when the service is on any public network.

-H


-- 
Henning Follmann           | hfollmann@itcfollmann.com

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

ssh doesn't work. EenyMeenyMinyMoa <eenymeenyminymoa@gmail.com> - 2016-12-06 05:40 +0100
  Re: ssh doesn't work. Andy Smith <andy@strugglers.net> - 2016-12-06 07:30 +0100
    Re: ssh doesn't work. EenyMeenyMinyMoa <eenymeenyminymoa@gmail.com> - 2016-12-07 16:30 +0100
      Re: ssh doesn't work. Henning Follmann <hfollmann@itcfollmann.com> - 2016-12-07 17:00 +0100
        Re: ssh doesn't work. EenyMeenyMinyMoa <eenymeenyminymoa@gmail.com> - 2016-12-07 18:40 +0100
          Re: ssh doesn't work. Greg Wooledge <wooledg@eeg.ccf.org> - 2016-12-07 19:00 +0100
            Re: ssh doesn't work. EenyMeenyMinyMoa <eenymeenyminymoa@gmail.com> - 2016-12-08 05:20 +0100
          Re: ssh doesn't work. Henning Follmann <hfollmann@itcfollmann.com> - 2016-12-07 19:20 +0100
            Re: ssh doesn't work. Greg Wooledge <wooledg@eeg.ccf.org> - 2016-12-07 19:50 +0100
              Re: ssh doesn't work. Henning Follmann <hfollmann@itcfollmann.com> - 2016-12-07 20:20 +0100
              Re: ssh doesn't work. Antti Talsta <atalsta@nothingtosee.org> - 2016-12-07 20:30 +0100
                Re: ssh doesn't work. Reco <recoverym4n@gmail.com> - 2016-12-07 21:30 +0100
                Re: ssh doesn't work. Henning Follmann <hfollmann@itcfollmann.com> - 2016-12-07 21:50 +0100
                Re: ssh doesn't work. Reco <recoverym4n@gmail.com> - 2016-12-07 23:20 +0100
                Re: ssh doesn't work. Darac Marjal <mailinglist@darac.org.uk> - 2016-12-08 16:40 +0100
                Re: ssh doesn't work. Reco <recoverym4n@gmail.com> - 2016-12-08 18:00 +0100
                Re: ssh doesn't work. Antti Talsta <atalsta@nothingtosee.org> - 2016-12-07 21:50 +0100
                Re: ssh doesn't work. Reco <recoverym4n@gmail.com> - 2016-12-07 23:20 +0100
              Re: ssh doesn't work. Brian <ad44@cityscape.co.uk> - 2016-12-07 21:30 +0100
                Re: ssh doesn't work. EenyMeenyMinyMoa <eenymeenyminymoa@gmail.com> - 2016-12-08 05:20 +0100
                Re: ssh doesn't work. Lisi Reisz <lisi.reisz@gmail.com> - 2016-12-08 11:10 +0100
                Re: ssh doesn't work. EenyMeenyMinyMoa <eenymeenyminymoa@gmail.com> - 2016-12-10 06:00 +0100
                Re: ssh doesn't work. Joe <joe@jretrading.com> - 2016-12-10 10:10 +0100
                Re: ssh doesn't work. Richard Hector <richard@walnut.gen.nz> - 2016-12-11 08:40 +0100
            Re: ssh doesn't work. EenyMeenyMinyMoa <eenymeenyminymoa@gmail.com> - 2016-12-08 06:50 +0100
              Re: ssh doesn't work. emetib <chadbrabec@gmail.com> - 2016-12-08 09:00 +0100
                Re: ssh doesn't work. Henning Follmann <hfollmann@itcfollmann.com> - 2016-12-08 13:50 +0100
          Re: ssh doesn't work. emetib <chadbrabec@gmail.com> - 2016-12-07 20:20 +0100

csiph-web