Hacker News Reader

Comment by zlynx | Hacker News Reader

It might help protect against an OpenSSH zero-day but those are pretty rare.

I've been running my home server with an completely open SSH port since 2012 and haven't been hacked yet. And I know since I check occasionally with Tripwire and/or RPM verification from a clean boot.

The only downside to an open SSH port is the thousands and thousands of log spams from connection attempts. The upside is that I can log in from anywhere using my phone directly or as a hotspot for the laptop.

Oh yeah, and VPN just pushes the problem back one level. For me SSH is the VPN. Requiring VPN access first to get to SSH is just pushing any security problems back into the VPN server. Because now IT is the one with the open port to the internet.

View on HN

Can you use Tripwire for free for home/consumer stuff? And what does RPM verification do? Just make sure all the packages you have installed are legit?

Tripwire is packaged up in Fedora. It's listed as GPLv2 licensed. So, yes.

RPM verification checks that all of the files installed through RPM have checksums that match the original RPM. It also checks that the RPM cryptographic signatures match.

So that should guarantee that files like the kernel, systemd, /bin/sh, /lib/libc.so.6, etc are not compromised.

A system can still be vulnerable to persistent attacks installed in unwatched files such as /root/.bash_profile, /etc/profile.d, extra files in /usr/systemd/system, etc. So you also have to check for extra files that you didn't install.

I don't have anything except Secure Boot to protect against UEFI attacks.

Got it. Thanks!

That is the thing, if we are talking about my personal linux server I am good with key auth + fail2ban and ssh on high port to have less spam in logs.

For work related stuff if I have to deal with multiple people accessing multiple servers then it is different story. Strictly forbidding ssh to have people connect from one IP is a lot more control. Then also key auth but I don't have to setup some google auth.

Agreed. The guide is intended for a home server. Anything more and you'd need a more robust network with dedicated firewalls and a DMZ, etc....

If you use an UDP VPN on an non-standard port it's quite a bit harder to find than SSH on a TCP port.

if your primary goal just is to hide SSH then you could have it on a none-standard port and enable port-knocking. Then you’re reducing your visibility to network traces.

Ultimately though, many would argue that’s just security through obscurity so you’d still want something like fail2ban or denyhosts running - namely a tool that monitors your log files for failed log in attempts (or other suspicious activity) and then auto blacklist that IP in your filewall. I’d personally recommend fail2ban over denyhosts for a variety of reasons but ultimately either is better than none.

What I also like to do is have the public SSH box a bastion server with its own unique credentials so you effectively have the same multi-tiered authentication as you would for VPN.

You can also add MFA for SSH too if you wanted. In fact there are a few PAM modules you can use; from captchya’s (to reduce bot effectiveness) to Google Authenticator.

Even enhanced SSH tools like the file server protocol (SFTP / scp / etc) and port forwarding can be enabled or disabled for specific logins / groups or everybody if you wanted.

So it’s entirely possible to harden SSH in the same way you would VPN.

Thanks for the idea on port knocking. I always forget about it. Will look into it more...

Reply on news.ycombinator.com