Hacker News Reader

Comment by deutronium | Hacker News Reader

Or possibly set up port knocking, may be overkill though

Is port knocking a common defense these days? I remember reading about it awhile ago, and thought it was a neat idea but didn't really think people would actually use it.

I use it. It's really handy, but somewhat cumbersome if you just want to jump on an SSH shell to a box from a new machine.

I compromised on some of my boxes and made a non-published/non-linked URL that if you hit it, your source IP will end up on the SSH-allowed list. That plus a non-standard SSH port seems to keep 99.9999% of the risk out of the way without being too overly cumbersome to knock-through when needed.

I don't think it is that popular too be honest, while it is good at preventing access from port scanners etc., the clients aren't standard utilities.

[EDIT] You could always just set up iptables to accept traffic from your ISPs subnet and deny the rest.

I use a simplified one port "port knocker" with iptables setup such that an ascending or descending linear port-scan will leave the ssh port closed upon completion.

Only one knock is needed to keep the port open for my current IP address indefinitely, or it can be closed immediately without losing my ssh connection.

It also precludes the necessity of filling up iptables with boatloads of DROPs to keep out the riff-raff.

IMO port knocking isn't good defense, people can always use nmap to scan for open ports then try some combinations on them. Certificate authentication is way better (in combination with disabling password login)

Certificate authorization alone may not protect you from 0-day exploits to your ssh server. Not all port knockers use that pinging ports combination technique. Again, I recommend a look at fwknop which addresses your concerns by using certificates actually.

Port knocking doesn't use open ports. It acts as a packet sniffer, and doesn't do anything to the port.

Reply on news.ycombinator.com