Changes sshd port every 30 seconds, using Two Factor Auth to login

Re:Changes sshd port every 30 seconds, using Two Factor Auth... by belorn on Sunday May 29, 2016 @03:50PM (#11797912)

Correct me if I am wrong here, but would the following changes to SSH give you the same result:

Change protocol from TCP to UPD and port from 22 to 62201.

Remove greeting.

If first message is not the correct password, do not send a reply.

If everyone used this, do you think SSH would become more secure and eliminate password scanners? Personally I think that if ssh took in a fwknopd patch and used that as default, any benefit you see now would disappear. I also suspect that logging every UDP package to 62201 would be a bad idea, probably worse than logging every failed attempt on TCP port 22.

[ Parent | on HN ]

Re:Changes sshd port every 30 seconds, using Two Factor Auth... by oneru on Sunday May 29, 2016 @11:29PM (#11799410)

Ssh does a fingerprint verification and establishes a secure channel before it does the password exchange. Avoiding replay attacks can be a challeng as well. Putting strong authentication in a single packet is deceptively nontrivial. It can be done, but at that point you'd be reimplementing Fwknopd. Additionally, Fwknop can protect more than just ssh, and do fancy things like providing access to a machine without a public IP address.

Disclaimer: I'm one of the Fwknop devs. =)

[ Parent | on HN ]