Timeline for Does it improve security to use obscure port numbers?
Current License: CC BY-SA 4.0
9 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 17, 2018 at 14:12 | comment | added | user6858980 | so what are the implications that don't make it practical? Your saying there is a problem without giving any information. The notion you cant send three packets via GSM on a train is nonsical, if you have a stable enough net connection to maintain a ssh connection you have enough to do for x in $PORT1 $PORT2 $PORT3; do nmap -Pn --host_timeout 201 --max-retries 0 -p $SERVER_IP; done; ssh user@$SERVER_IP. Or three telnets and a ssh. Tell me how you would exploit a vulnerable service or brute force something that is firewalled and not advertised? | |
| Jul 17, 2018 at 13:58 | comment | added | Tom | @user6858980 I called it "cutesy" because it's one of the things someone tells you at a conference and you go "now that's a neat idea", until you think through all the implications. And yes, sending 3 packets can be a hell of a task if you are, say, in an Internet cafe. I've restarted crashed servers using a Palm Pilot and a GSM (not 3G, not 2G, GSM) phone while riding the train. I've done troubleshooting on an iPad. Good luck getting your port knock done when you are in an emergency situation without your usual equipment. | |
| Jul 17, 2018 at 13:50 | comment | added | user6858980 | @Tom explain why you think its cute security? The port is fire walled off until you unlock it with this method, you then still have all your existing security measures in place. If your not advertising your port you will avoid the majority of net scans.. If the service behind the hidden port becomes vulnerable, it will also give you plenty of time to path before automated hacks start flooding in. Think how this could have stopped shellshock spreading so rapidly. Yes usability decreases, I now have to send 3 packets before I log in, such difficulty. | |
| Jul 17, 2018 at 13:25 | comment | added | Tom | @schroeder - you are right that key-based authentication is not much better in usability, but at least it is a standard procedure. My experience shows that your assumption will be correct 99% of the time, and wrong the one time when you really need to log on, but you're somewhere without your notebook. I've locked myself out of machines often enough to know that you always need to have at least one way in that requires no specific software or setup. | |
| Jul 17, 2018 at 13:19 | comment | added | schroeder♦ | @tom yes, I am assuming that. If your admins are logging in from unknown or uncontrolled machines, then you have another problem. Your comment about key-based is also confusing: key-based authentication is terrible for usability. I think you might need to expand what you mean in your original comment and what assumptions you are making as a basis. | |
| Jul 17, 2018 at 13:17 | comment | added | Tom | @schroeder you assume that you always do your admin stuff from the same machine where you have your nifty script handy. In that case, you don't need port knocking, key-based authentication will also make brute-force attacks pointless. | |
| Jul 17, 2018 at 12:25 | comment | added | schroeder♦ | @Tom unless you write a script to handle that for you... Usability for a remote admin is not really a huge concern. | |
| Jul 17, 2018 at 12:22 | comment | added | Tom | port knocking is a cutesy security idea, but it has absolutely terrible usability. | |
| Jul 17, 2018 at 11:24 | history | answered | user6858980 | CC BY-SA 4.0 |