Comment on [deleted]

emhl@feddit.org ⁨3⁩ ⁨weeks⁩ ago

• johannes@lemmy.jhjacobs.nl ⁨3⁩ ⁨weeks⁩ ago

  Which issues are you referring to?

  Using port 2222 may not prevent any real hackers from discovering it, but it sure does prevent a lot of them scripttkiddie attacks that use automated software.

  source

  • martinb@lemmy.sdf.org ⁨3⁩ ⁨weeks⁩ ago

    Passwordless login only. No root login. Fail2ban. Add ufw to stop accidental open port shenanigans, and you are locked down enough

    source

    • Botzo@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

      We can go harder: port knock to open the port to a cert-only VPN:

      wiki.archlinux.org/title/Port_knocking

      source

      • martinb@lemmy.sdf.org ⁨3⁩ ⁨weeks⁩ ago

        Felt a bit like a faff to me, so I never bothered. Does depend upon your threat model though

        source

        • -> View More Comments
    • StrixUralensis@tarte.nuage-libre.fr ⁨3⁩ ⁨weeks⁩ ago

      Passwordless login only

      Never understood this

      I don't think that anyone or anyrhing, computer or mentalist, will guess my 40+ characters long password

      source

      • non_burglar@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

        With ssh, over 90% of the vulnerabilities are abusing the password mechanism. If you setup pre-shared keys, you are preventing the most common abuses, including in the realm of zero days.

        source

        • -> View More Comments
      • etchinghillside@reddthat.com ⁨3⁩ ⁨weeks⁩ ago

        Are you setting and managing other’s passwords?

        source
      • surph_ninja@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

        Especially paired with Fail2Ban preventing any brute force attempts.

        But with a WireGuard setup, you need not have the port exposed at all.

        source
      • truthfultemporarily@feddit.org ⁨3⁩ ⁨weeks⁩ ago

        The idea behind keys is always, that keys can be rotated. Vast majority of websites to that, you send the password once, then you get a rotating token for auth.

        Most people don’t do that, but you can sign ssh keys with pki and use that as auth.

        Cryptographically speaking, getting your PW onto a system means you have to copy the hash over. Hashing is not encryption. With keys, you are copying over the public key, which is not secret. Especially managing many SSH keys, you can just store them in a repo no problem, really shouldn’t do that with password hashes.

        source
  • emhl@feddit.org ⁨3⁩ ⁨weeks⁩ ago

    Privileged ports can be used by processes that are running without root permissions. So if the sshd process would crash or stop for some other reason, any malicious user process could pretend to be the real ssh server without privilege escalation. To be fair this isn’t really a concern for single user systems. But setting up fail2ban or only making ssh accessible from a local network or VPN would probably be a more helpful hardenening step

    source

    • Laser@feddit.org ⁨3⁩ ⁨weeks⁩ ago

      Privileged ports can be used by processes that are running without root permissions.

      I guess you mean unprivileged ports?

      So if the sshd process would crash or stop for some other reason, any malicious user process could pretend to be the real ssh server without privilege escalation.

      Not really, except on the very first connection because you need access to the root-owned and otherwise inaccessible SSH host key, otherwise you’ll get the message a lot of people have probably seen after they reinstalled a system (something like “SOMEONE MIGHT BE DOING SOMETHING VERY NASTY!”).

      source
• Arigion@feddit.org ⁨3⁩ ⁨weeks⁩ ago

  Just use wireguard as VPN and bind ssh only to that interface. You loose public access but I couldn’t think of a reason why I want other devices than my own to connect anyway.

  source