I don't think anyone argues that obscurity is worthless. The argument is more that when it fails, it fails unpredictably and completely, so it's not something to be relied on. In a situation where you need every advantage you can get, go ahead and hide whatever will help.
If you're just opening up SSH on your personal computer, you don't need every advantage you can get. Just make sure that your authentication is strong, and you'll be fine.
You're missing the fact that when you remove the camo paint off of a tank you haven't made the armor any weaker, just as putting SSH on a different port doesn't mean you remove authentication.
And you're missing the fact that ssh is not a tank.
We could continue raping that metaphor, or we could just discuss whether or not putting ssh on a different port actually accomplishes anything useful.
For example: it's generally a pretty safe assumption that most remote servers have ssh running on them somewhere. If you are running scripts to find vulnerable or misconfigured ssh hosts, then it makes sense to scan the standard port and try stupid logins. In that case, if the sysadmin moves ssh to a different port, then they "protect" themselves from the various scripts out there, but then again simply having reasonable password policy accomplishes the same thing and without the hassle of having to locate ssh on a different port.
On the other hand, if you're a dedicated attacker and you want to compromise a particular system, then moving ssh to another port does squat; nmap will find it easily enough. Port knocking and/or denyhosts and/or iptables or pf will stop that easily enough, but then again, a dedicated attacker probably won't try ssh first anyway, since that's hard. Attacking something else like your web app or any of your other services, would make a lot more sense.
So, either way, running ssh on a different port is completely superfluous. While you haven't "made the armor any weaker", you also haven't made it any stronger. At all.
I think the argument is that security only by obscurity is not security. Obscure and good is a better alternative. The example for this topic would be a non standard port, but no password - nice and convenient, and it's unlikely anyone would find the port, but when it's found there's no security left.
Why do you think I'm missing that? Was it the part where I said that you should go ahead and obscure things in situations where you need every advantage you can get? (i.e. where I explicitly acknowledged that)
It costs something to use a port knocker. It costs something to use a nonstandard port. If you have strong authentication (say, using 2048-bit ssh certificates), it's probably not worth paying those costs. Maybe it is if you're a bank, but probably not if it's the server that hosts your blog. If you don't have that strength of authentication, it would be better to pay for the better authentication than for the port knocker and nonstandard port.
Comments
For anyone who doubts the merits of obscurity for security:
http://danielmiessler.com/study/security_and_obscurity/
Hint: Why do we camouflage tanks?
I don't think anyone argues that obscurity is worthless. The argument is more that when it fails, it fails unpredictably and completely, so it's not something to be relied on. In a situation where you need every advantage you can get, go ahead and hide whatever will help.
If you're just opening up SSH on your personal computer, you don't need every advantage you can get. Just make sure that your authentication is strong, and you'll be fine.
You're missing the fact that when you remove the camo paint off of a tank you haven't made the armor any weaker, just as putting SSH on a different port doesn't mean you remove authentication.
And you're missing the fact that ssh is not a tank.
We could continue raping that metaphor, or we could just discuss whether or not putting ssh on a different port actually accomplishes anything useful.
For example: it's generally a pretty safe assumption that most remote servers have ssh running on them somewhere. If you are running scripts to find vulnerable or misconfigured ssh hosts, then it makes sense to scan the standard port and try stupid logins. In that case, if the sysadmin moves ssh to a different port, then they "protect" themselves from the various scripts out there, but then again simply having reasonable password policy accomplishes the same thing and without the hassle of having to locate ssh on a different port.
On the other hand, if you're a dedicated attacker and you want to compromise a particular system, then moving ssh to another port does squat; nmap will find it easily enough. Port knocking and/or denyhosts and/or iptables or pf will stop that easily enough, but then again, a dedicated attacker probably won't try ssh first anyway, since that's hard. Attacking something else like your web app or any of your other services, would make a lot more sense.
So, either way, running ssh on a different port is completely superfluous. While you haven't "made the armor any weaker", you also haven't made it any stronger. At all.
Because ssh is not a tank.
I think the argument is that security only by obscurity is not security. Obscure and good is a better alternative. The example for this topic would be a non standard port, but no password - nice and convenient, and it's unlikely anyone would find the port, but when it's found there's no security left.
Why do you think I'm missing that? Was it the part where I said that you should go ahead and obscure things in situations where you need every advantage you can get? (i.e. where I explicitly acknowledged that)
It costs something to use a port knocker. It costs something to use a nonstandard port. If you have strong authentication (say, using 2048-bit ssh certificates), it's probably not worth paying those costs. Maybe it is if you're a bank, but probably not if it's the server that hosts your blog. If you don't have that strength of authentication, it would be better to pay for the better authentication than for the port knocker and nonstandard port.
For those who did not read the article:
Difference between using usual 22 and "unusual" 24 port, 18000 attempts vs. 5 attempts over one weekend.
Seems to weed out script kiddies quite quickly.
Personally, I don't see anything wrong with having 3 locks on the door:
Another analogy would be one bouncer, one secret knock, and one nonstandard keyhole.Of course, one still wants to have a difficult to pick key after all that.
So bored intel ops can play spot-the-difference between natural and IR images?