Tosh: Changing your SSH server's listen address every 30 seconds based on TOTP

Re:Tosh: Changing your SSH server's listen address every 30 ... by hannob on Sunday May 23, 2021 @04:55AM (#27253431)

There's also a principle in security that's called simplicity.

"Defense in depth" is often quoted when people want to add further complexity to a system. There are cases where adding a security mechanism that adds complexity has a benefit that is so large that it's justified (e.g. adding TLS or ASLR). But it always needs to be balanced, because complexity adds attack surface.

The system linked here seems like it's adding a whole lot of complexity and only has a very weak case to be made for what it's good for.

[ Parent | on HN ]

Re:Tosh: Changing your SSH server's listen address every 30 ... by CydeWeys on Sunday May 23, 2021 @10:23AM (#27255185)

Not making your servers SSHable from the public Internet is absolutely worth it though, and has better simplicity than exposing them (which requires setting up firewall/NAT routes).

To be clear, we haven't been talking about the OP port-shuffling scheme for many posts now in this subthread. We're talking about not having your servers be externally SSHable, period.

[ Parent | on HN ]

Re:Tosh: Changing your SSH server's listen address every 30 ... by Aeolun on Sunday May 23, 2021 @06:53AM (#27254065)

That’s probably why it is described as a toy.

[ Parent | on HN ]