I thumbs downed the article because as a security professional we try to stress the importance of actual security rather than obscuring the problem for long term success.
Take port knocking for example, interesting idea but what a pain in the ass... just disable root and set a strong password.
Changing the port from 22 will prevent all of the automated botnet driven SSH brute force attacks, which do little more than messy up your log directories.
this is how matasano got owned. an easily guessable account got broken into and root priv escalation was used. if they were using port knocking an attacker would have had to be in the middle, which is possible but adds an extra 'auth' layer so increases overall intrusion hardness.
also, everyone keeps talking up these scripts to stop brute forcing... two iptables rules will do this for you.
Actually, this works for a practical reason: scanning ports takes time and resources, and script kiddies are more likely to move on to the next target if they don't find a worthwhile target in the first few thousand ports. It won't help against a determined attacker, of course, but it does reduce the number of less-skilled attacks.
If there is a 0-day or unreleased SSH vulnerability, your login security doesn't matter. In those cases, it helps if the s'kiddies skipped your site altogether because they couldn't be bothered to wait to find where your ssh port is.
But no, he's arguing that even if you had the best armor in the world, an international agreement that all tanks must park at the top of the nearest hill would be Bad for the life expectancy of the crew.
Comments
Security by obscurity, thumbs down.
nmap -sV -p1-65000 ip
Ok, maybe not so flippant comment this time...
I thumbs downed the article because as a security professional we try to stress the importance of actual security rather than obscuring the problem for long term success.
Take port knocking for example, interesting idea but what a pain in the ass... just disable root and set a strong password.
Changing the port from 22 will prevent all of the automated botnet driven SSH brute force attacks, which do little more than messy up your log directories.
Best thing you can do is use SSH brute force blocking script which reports attackers back to a webapp which the security community can use to track infected hosts. example: http://danger.rulez.sk/projects/bruteforceblocker/blist.php
Fail2ban is a nice one too as it supports many services including http-auth.
this is how matasano got owned. an easily guessable account got broken into and root priv escalation was used. if they were using port knocking an attacker would have had to be in the middle, which is possible but adds an extra 'auth' layer so increases overall intrusion hardness.
also, everyone keeps talking up these scripts to stop brute forcing... two iptables rules will do this for you.
Actually, this works for a practical reason: scanning ports takes time and resources, and script kiddies are more likely to move on to the next target if they don't find a worthwhile target in the first few thousand ports. It won't help against a determined attacker, of course, but it does reduce the number of less-skilled attacks.
People keep mentioning this, and I really don't understand why.
Do you have a username/password or username+certificate that a script kiddy is likely to hit in their first 10,000 attempts?
If yes, you have a much larger problem that can't be solved by port knocking or moving ssh to a different port.
If not, then you're trying to solve a problem which doesn't exist anyway.
If there is a 0-day or unreleased SSH vulnerability, your login security doesn't matter. In those cases, it helps if the s'kiddies skipped your site altogether because they couldn't be bothered to wait to find where your ssh port is.
Ah, thanks. That's a big if, but it has happened, so it makes some sense.
Wrong.
http://danielmiessler.com/study/security_and_obscurity/
Ask yourself why, if obscurity is worthless, does every military put camouflage on its tanks?
[deleted]
RTFA.
But no, he's arguing that even if you had the best armor in the world, an international agreement that all tanks must park at the top of the nearest hill would be Bad for the life expectancy of the crew.