Essential security for Linux servers (2013)

Re:Essential security for Linux servers (2013) by cube00 on Wednesday December 08, 2021 @07:52AM (#29484113)

Keep in mind the danger that if the SSH server crashes other non-privileged users on that box can launch a fake server on that >1024 port to take its place.

[ Parent | on HN ]

Re:Essential security for Linux servers (2013) by bell-cot on Wednesday December 08, 2021 @03:21PM (#29489959)

But unless the non-privileged users have access to the ssh key files - definitely not allowed in any sane set-up - their MITM sshd will be throwing big, obvious error messages at most of the users. (Which is the mechanism protecting you against MITM's via all sorts of "intercept the packets" network attacks.)

[ Parent | on HN ]

Re:Essential security for Linux servers (2013) by abdusco on Wednesday December 08, 2021 @08:40AM (#29484541)

Huh. I wasn't aware of this vector.

My servers only have `root` and my own sudo user, (and other default system users). I also run all apps on Docker. I don't think this would be an issue for me.

[ Parent | on HN ]

Re:Essential security for Linux servers (2013) by nijave on Wednesday December 08, 2021 @02:35PM (#29489338)

I guess you could probably setup a port rewrite firewall rule? Translate 10000 to 22, for instance and have 22 blocked for external connections

[ Parent | on HN ]