News for hackers. Stuff that matters.

A comment on Obscurity: Does Changing Your SSH Port Lower Your Risk?.

Re:Obscurity: Does Changing Your SSH Port Lower Your Risk? by mseebach on Friday February 18, 2011 @12:16PM (#2236270)
Not being on port 22 raises the bar for getting into your server slightly, but as both the article and others here point out, you still get connections.

That means:

- If you have a guessable user name / password, you will still get hacked, and probably also by more determined people - which leads to:

- Those determined to get into your server will be delayed a few seconds, at most.

It's fine, do it, but only to get the bulk of the automated attacks out of your firewall / logs. If you're uncomfortable running SSH on port 22, your setup isn't safe enough, and switching ports is just putting a band-aid on an infected wound.

Hints:

- Root can't login from SSH. Use sudo.

- Public key only.

- If you have multiple servers, only one can accept SSH connections from the world. Preferably not in the same IP-subnet, much less domain, as any public facing server. Use this as gateway to other servers.

- IP whitelist, if practical.

[ Parent | on HN ]
Re:Obscurity: Does Changing Your SSH Port Lower Your Risk? by njharman on Friday February 18, 2011 @02:35PM (#2236888)
> raises the bar for getting into your server slightly,

Talking about bots/viruses/script kiddies and not targeted attacks. 18,000 to 5 is not what I would call slightly. In fact I would call it 4 orders of magnitude greater. Extremely greater.

[ Parent | on HN ]
Re:Obscurity: Does Changing Your SSH Port Lower Your Risk? by johnthedebs on Friday February 18, 2011 @03:25PM (#2237088)
There would be fewer hits on the port sure, but it wouldn't really raise the bar to getting in, which is the point he was trying to make.

Obviously, not all 18,000 of those attempts were going to succeed. Finding the port is the easy part.

[ Parent | on HN ]
Re:Obscurity: Does Changing Your SSH Port Lower Your Risk? by goldmab on Friday February 18, 2011 @02:13PM (#2236775)
If you can log in as account xyz over SSH, and account xyz has permission to do anything with sudo, how is that more secure than letting root log in over SSH?
[ Parent | on HN ]
Re:Obscurity: Does Changing Your SSH Port Lower Your Risk? by KaeseEs on Friday February 18, 2011 @02:15PM (#2236789)
If root can log in, the username is definitely known to the attacker and they must figure out the password. If root can't log in, the username of someone with an entry in sudoers probably isn't known to the attacker, so they must figure out both the username and password.
[ Parent | on HN ]
Re:Obscurity: Does Changing Your SSH Port Lower Your Risk? by goldmab on Friday February 18, 2011 @02:27PM (#2236853)
I do like this answer, but I'll also point out that making someone guess two strings is just as secure as making them guess one long string. If root has a random 10-char password, that's roughly the same number of guesses as a user's first name with an 8-char password.
[ Parent | on HN ]
Re:Obscurity: Does Changing Your SSH Port Lower Your Risk? by Peaker on Friday February 18, 2011 @03:53PM (#2237215)
Unless they can read the shadow file somehow, or a specific user attack vector makes it somewhat easier than complete guessing...
[ Parent | on HN ]
Re:Obscurity: Does Changing Your SSH Port Lower Your Risk? by jarek on Friday February 18, 2011 @03:56PM (#2237234)
I'm not up to speed on security, but it appears to me that your sudo password should probably be different from your account password, so the scenario turns into figuring out the username and two passwords.
[ Parent | on HN ]
Re:Obscurity: Does Changing Your SSH Port Lower Your Risk? by pyre on Friday February 18, 2011 @10:44PM (#2238306)
Is that even possible? I've never heard of anyone having a separate sudo password.
[ Parent | on HN ]
Re:Obscurity: Does Changing Your SSH Port Lower Your Risk? by daxelrod on Saturday February 19, 2011 @01:57AM (#2238643)
Yes. Here's how to set a separate sudo password:

Assume your primary user account is called "user".

Set up a second account, whose password you want to be your sudo password. Let's call this account "admin".

In /etc/sudoers:

  Defaults:user runas_default=admin
  Defaults:user runaspw
Now, as "user", you can

  sudo -u root whoami
and you will be asked for "admin"'s password.

The only downside is that "root" is no longer the default user to become, you have to explicitly specify it.

[ Parent | on HN ]
Re:Obscurity: Does Changing Your SSH Port Lower Your Risk? by jarek on Friday February 18, 2011 @10:53PM (#2238317)
Hm... would the user not being in sudoers and using su with root password being different than the user password make more sense?
[ Parent | on HN ]
Re:Obscurity: Does Changing Your SSH Port Lower Your Risk? by oreilly on Saturday February 19, 2011 @12:42AM (#2238516)
To log in via SSH, you (should) have a key, and a password for that key. To sudo on the server should require a different, complex password for the paranoid admin. (So 2 long passwords and a key to gain sudo priv's)
[ Parent | on HN ]