I thumbs downed the article because as a security professional we try to stress the importance of actual security rather than obscuring the problem for long term success.
Take port knocking for example, interesting idea but what a pain in the ass... just disable root and set a strong password.
Changing the port from 22 will prevent all of the automated botnet driven SSH brute force attacks, which do little more than messy up your log directories.
this is how matasano got owned. an easily guessable account got broken into and root priv escalation was used. if they were using port knocking an attacker would have had to be in the middle, which is possible but adds an extra 'auth' layer so increases overall intrusion hardness.
also, everyone keeps talking up these scripts to stop brute forcing... two iptables rules will do this for you.
Comments
Ok, maybe not so flippant comment this time...
I thumbs downed the article because as a security professional we try to stress the importance of actual security rather than obscuring the problem for long term success.
Take port knocking for example, interesting idea but what a pain in the ass... just disable root and set a strong password.
Changing the port from 22 will prevent all of the automated botnet driven SSH brute force attacks, which do little more than messy up your log directories.
Best thing you can do is use SSH brute force blocking script which reports attackers back to a webapp which the security community can use to track infected hosts. example: http://danger.rulez.sk/projects/bruteforceblocker/blist.php
Fail2ban is a nice one too as it supports many services including http-auth.
this is how matasano got owned. an easily guessable account got broken into and root priv escalation was used. if they were using port knocking an attacker would have had to be in the middle, which is possible but adds an extra 'auth' layer so increases overall intrusion hardness.
also, everyone keeps talking up these scripts to stop brute forcing... two iptables rules will do this for you.