News for hackers. Stuff that matters.

A comment on Bastion hosts. Parent comment

Re:Bastion hosts by arde on Thursday November 20, 2014 @05:47PM (#8638678)
Regarding item 4, a VPN solution is considerably more complex and error prone than port knocking plus SSH. What do you do if/when your VPN service fails? I think you would usually have a VPN service AND a port knocked SSH backdoor.
[ Parent | on HN ]
Re:Bastion hosts by peterwwillis on Friday November 21, 2014 @09:38AM (#8641428)
Yes, good security is usually more complex, though error prone I don't think is accurate. What do you do when your SSH or port knocking service fails?
[ Parent | on HN ]
Re:Bastion hosts by e40 on Sunday November 23, 2014 @06:03PM (#8650289)
Yes, good security is usually more complex

Wow. So, in your mind software that is more complex is more secure. OK, I think I understand the origin of a lot of your comments, then.

We completely and fundamentally disagree.

What do you do when your SSH or port knocking service fails?

That's a complete red herring. What do you do when your firewall fails??

[ Parent | on HN ]
Re:Bastion hosts by arde on Friday November 21, 2014 @01:58PM (#8642684)
I meant its configuration and maintenance is more error prone. Certificates may expire without renewal, for example. I've seen port knocking work without a flaw for over ten years in a row, and the SSH configuration is shorter and almost never changes (unless it is to change the cipher or the user).
[ Parent | on HN ]
Re:Bastion hosts by peterwwillis on Friday November 21, 2014 @02:22PM (#8642830)
A side-by-side comparison would require side-by-side configuration. And you can totally configure both SSH and a VPN the same way.

Both ssh and a vpn support authenticating with public keys. Both require maintenance on security updates, or to gain new features, or to strengthen ciphers used, or allow a new user access.

You mention certificates. You do not need to use certificates with either, though you can. You do not need to validate certificate expiration with either, though you can. You can also set expiration to some year well past when the technology will even be relevant.

You claim that expiration of a certificate is somehow a flaw, yet it exists as a security feature. If what you want is to be more secure, you would be wise to use this feature, and not discard it as an annoying maintenance task. However, happily, you can easily ignore it with a VPN just as you do with SSH.

[ Parent | on HN ]