Re:Security by obscurity is underrated
by scarmig on Friday September 11, 2020 @02:36PM
(#24445909)
Each security measure has a value and a cost. Keys over passwords provide by far the best value/cost ratio. Using obscure ports or port knocking or whitelisted IPs are relatively clunky mechanisms that are more expensive and obscure your security posture as much to yourself as to adversaries.
[ Parent
| on HN ]
This is absolutely true, but in some ways this is more about reducing the number of 'attempted connections' in the sshd log. Meaning, any failed connection that is recorded (and ideally shipped off to a centralized log system) is in some way actionable. Opening up port 22 (with keys) will still create tonnes of alerts from any SIEM.
The other thing to consider is that there could be exploits in OpenSSH itself. There hasn't been a truly critical vulnerability in a very long time, but low severity or non RCE vulnerabilities aren't exactly rare: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=openssh
Re:Security by obscurity is underrated
by somedude11 on Friday September 11, 2020 @05:31PM
(#24447533)
>obscure your security posture as much to yourself as to adversaries
Almost barfed from sheer intensity of tech corpobabble. Its for blocking 0-days dummy!