We have a jump box that allows people to connect via SSH into the system.

Would it be a security concern by adding a public DNS entry that points to the jump box? (Would this not be security through obscurity?)

Assuming our system is hardened, there is really nothing wrong with having a DNS entry to the jump box.

  • “Would it be a security concern by adding a public DNS entry that points to the jump box?“ - concern from who? Anyone, employees for example, who have visibility of the dns server entries can now see you have a device which maybe was unknown to them before. But, is that a security concern? – ISMSDEV Sep 7 '19 at 6:52

I suppose in principle that the DNS entry leaks a tiny amount of information, but assuming your DNS servers are tied down against third-party zone transfers, the only way to extract this from the DNS is to know it exists, so no information leakage there. Most ssh attacks come from bots stepping through the whole IPv4 space looking for responses on port 22, and DNS entries have nothing to do with that.

I would probably name it something innocuous, though: ssh-gateway-to-the-vital-code-repository.example.com is not a great idea.

As you note in passing, there are a bunch of other measures well-designed for securing a jump box (including non-standard sshd ports, rate-limiting, disallowing password-based authentication / requiring 2FA, hardened OS). I'd put a lot more time into them than into worrying about my DNS entry.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.