Hacker News Reader

Comment by ggm | Hacker News Reader

Eh. He doesn't discuss which public dns upstream supports dtls and in some sense it's just picking who snoops, ie he argues against cloudflare snooping but doesn't discuss who else might.

Run hyperlocal root, run your own dns.

His "don't move off 22 for ssh" is also just opinion. He argues "you will be found" but misses the experience of those of us running on shifted ssh is continuously validated by the visibly lower level of probes we see. He offers no mathematical analysis of how quickly a port knock sequence will be uncovered, and again dismisses it as infeasible and useless.

I've got nothing against strongly held opinions and these are his. But, form your own opinions too.

View on HN

> His "don't move off 22 for ssh" is also just opinion. He argues "you will be found"

Worse than that, that post misunderstands it's own statement:

"Sure, you will see fewer attacks than before, but most of the attackers are no longer just stupid bots"

That's a *good* thing, because the move has reduced the signal to noise ratio. By getting rid of most of the crufty noise of the internet, you now know that anything hitting your logs now is more likely to be an actual threat than the poorly automated dictionary attack bots.

Moving SSH to a different port doesn't make the system much more secure (and definitely shouldn't be the only thing you do), but it does generally enable you to be more responsive.

I'm going to mention again dns0.eu which does support DNS over TLS. I haven't looked in-depth but I'm pretty sure some corporate networks block it somehow because on some networks my Android phone fails to connect to it.

If privacy is your concern then dns0.eu is not "no logs" (like BlahDNS or Mullvad DoH/DoT are, for example). They share "anonymized intelligence feeds" with their partners: https://docs.dns0.eu/threat-intelligence-partners/anonymized...

Thank you for the heads-up. That's an important point, and I wasn't aware about that feature.

In terms of privacy, they still preserve it (according to GDPR principles).

Yeah I get almost no login attempts on ports other than 22. Should I even care about attempts on 22 though? They bounce off, and fail2ban blocks the IP after a while.

I sometimes think of putting my private servers on completely random IP addresses drawn from /64 IPv6 ranges. It should be near-impossible to find those by address scanning, unless I'm overlooking something dumb. Am I? It wouldn't surprise me.

An arbitrary IPv6 address is indeed not practical to find by scanning. However, unless you're willing to type in that 128-bit value each time you need it (which maybe you are) you'll advertise this address somehow and if you do that your advertisements can be read by others.

For example suppose you put my-private-server.vanity-domain.example in DNS with an AAAA pointing to your private server - "passive DNS" service means big DNS providers will sell the answers they saw when anybody (say, yourself, on somebody else's computer) asks AAAA? my-private-server.vanity-domain.example. They don't reveal who asked, so this isn't personal information, but they do reveal what the question was and its answer.

A long time ago we used this to build target portfolios, if we're going to sell your company our product X, this is way we can see that you already have products A, B and C, but not D, E or F so we look a bit smarter coming into the sale.

Couldn't you just make my-private-server.vanity-domain.example a manual /etc/hosts entry to prevent advertising it?

You could. You'd only have the ability to log in from your own machine though. If that compromise works is very much dependent on your situation.

Yes, that's the idea of a private server. All the clients allowed to connect to it are mine, or at least authorized by me on a very small scale. Think of a backup server or a jump host.

Come to think of it, I could have a private DNS too. I haven't bothered with that.

At that point don't open port 22 to the internet, just set up wireguard or tailscale.

Just as easy, you could just set the Host in your ssh config. Then you don’t have to deal with dns

For a real world example, I use IPv6 only SSH+public DNS and my fail2ban has 2 fails for a uptime with 285 days.

I agree that sooner or later your SSH port will end up on Shodan anyway. Putting SSH behind a Wireguard VPN solves this completely.

Reply on news.ycombinator.com