Comment on Another good reason not to open port 22

elscallr@lemmy.world ⁨1⁩ ⁨year⁩ ago

• FarraigePlaisteach@kbin.social ⁨1⁩ ⁨year⁩ ago

  I have read elsewhere that port knocking is just security through obscurity and isn’t worth considering. I found it when searching for ways to set it up and that put me off.

  source

  • elscallr@lemmy.world ⁨1⁩ ⁨year⁩ ago

    It is and it isn’t. It prevents random scans from opening 22 and attempting to authenticate, that’s basically the entire purpose. You still need good authentication after because you’re right, it’s not a security measure, it’s just a way to keep your logs useful and to keep botnets from beating the hell out of 22.

    By “good authentication” I mean a key pair based authentication. That is impossible to brute force. If you use a password on 22 you shouldn’t open it at all and you should rethink allowing any remote access.

    source

    • FarraigePlaisteach@kbin.social ⁨1⁩ ⁨year⁩ ago

      When you put it that way, it sounds beneficial and like something I’d like to use. Thank you!

      The article may have been dissing it as a sole strategy.

      source

      • elscallr@lemmy.world ⁨1⁩ ⁨year⁩ ago

        It’s not uncommon for people to try using it as their sole authentication so that wouldn’t be a surprise. But for it’s purpose, it’s perfect.

        source
    • Hector_McG@programming.dev ⁨1⁩ ⁨year⁩ ago

      But if they don’t know they have to knock “shave and a haircut” first, your job gets a lot easier and you’re dealing with a lot fewer nuisance password promptings.

      Very good explanation. And the benefits are even greater, because there is absolutely no response until the entire secret knock is correctly used, the random guy trying to get in doesn’t even know if there’s anyone at that address. (In fact, set up correctly, they won’t even know if there’s really a door there or not)

      source
  • Ondergetekende@feddit.nl ⁨1⁩ ⁨year⁩ ago

    Security through obscurity is a very valid way to secure something. It shouldn’t be the only way of securing something, but it can be a valid additional layer.

    The knock sequence is a secret, just like a password. It may not be a particularly strong secret, but is is strong enough to keep out casual attackers. You’ll still need additional security, but sshd is well equipped to provide that.

    source
  • Hector_McG@programming.dev ⁨1⁩ ⁨year⁩ ago

    If you want to go down that path, a password is only security by obscurity.

    Port knocking is an extra layer of security, and one that can stop attackers from ever knowing your private server even exits. A random scanner won’t even see any open ports.

    Always bear in mind that any random guy advising people not to use port knocking msg be doing it with malicious intent. I’m sure there’s someone out there advising that random passwords are a waste of time, and everyone should just use monkey123.

    source