2

In order to increase security, for example on ssh remote connections, I:

  1. open a non stardard port.
  2. use mandatory digital certificates for authentication.
  3. allow connection from a ip range only.

But I wonder if this is enough to protect my ssh remote access. I was wondering if there is any script or solution doing this:

  • listen on syslog and filter ssh access intents.

  • if a predefined ports sequence is detected, then open for some minutes your non standard ssh port, then close it again if there is no active session.

So this is a "ports key" implementation. Do you know if a similar solution exists? Do you think such a tool is interesting to increase security levels?

  • 1
    Looks like you are asking for port-knocking. There are many posts about this here. – Steffen Ullrich Jun 27 '17 at 9:48
  • 1
    You will also want to look up "security by obscurity". Yes, it adds some level of security, but only by reducing the threat surface a little. – schroeder Jun 27 '17 at 9:55
  • Denyhosts or fail2ban will fulfill your first requirement, and your second just describes basic VPN functionality (make certain network resources available for a limited time after authenticating over an unrelated set of ports). – Ivan Jun 27 '17 at 15:00
3

Here is an article about port-knocking: https://www.digitalocean.com/community/tutorials/how-to-use-port-knocking-to-hide-your-ssh-daemon-from-attackers-on-ubuntu

And as schroeder said above - this is security by obscurity, it does not make your system more secure. If you are looking for securing your box and still need access to it from any IP address, consider using VPN with SSL certificates to authenticate against the system and then connect to your SSH server. Otherwise just allow access to your SSH from a range of trusted IPs.

0

There is a tool for port knocking, knockd used in conjunction with a good firewall like iptables.

Then use a script using nmap or knock to access the port.

-1

That's called port knocking.

A non standard port and port knoching doesn't make your machine more secure, namely if your password is strong, you don't need to use a non standard port. If your password isn't strong, using a non standard port won't help you. The same goes for a certificate.

  • 2
    I do not agree. By moving or even hiding a common port like ssh, you reduce your threat surface, and prevent 99% of the brute-force attempts you might otherwise experience. It's not an account compromise issue, but a load and logging issue. – schroeder Jun 27 '17 at 12:24
  • @schroeder, go brute-force my server: that won't make it less secure. – アレックス Jun 27 '17 at 13:59
  • you avoided my point – schroeder Jun 27 '17 at 14:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.