Michael Rash

I love the idea of Single-Packet Authorization with fwknop instead of port knocking: http://www.cipherdyne.org/fwknop/

Hmmm, can't see any mentions of fwknop https://www.cipherdyne.org/fwknop/

> I don't use port-knocking but I really just don't get all those saying: "It's security theater". It's not security theater but it's kind of outdated. Single Packet Authentication[0] is a significant improvement. > How many exploits rendered cold dead in their tracks by port-knocking shall we need before people stop saying port-knocking is security theater? Port knocking is one layer, but it shouldn't be the only one, or even a heavily relied upon one. Plenty of people might be in a position to see the sequence of ports you knock, for example. Personally, I think if more people bothered to learn tools like SELinux instead of disabling it due to laziness or fear, that is what would stop most exploits dead. Containers are the middleground everyone attached to instead, though. [0] https://www.cipherdyne.org/fwknop/docs/SPA.html

Note that port knocking is vulnerable to replay attacks. Single Packet Authentication is better, but requires a private key (can be your SSH key). https://www.cipherdyne.org/fwknop/

sounds fun; i see the arch aur has a few options as well. have you tried https://www.cipherdyne.org/fwknop/ ?

We install it from source[1] on our firewalls and use really long passwords stored in 1Password and I use the Homebrew 1Password CLI (`op`) to script the knocking when I start my day. [1] https://www.cipherdyne.org/fwknop/download/

Single packet authorization. It's like the server is not even there unless you send a cryptographically signed packet https://cipherdyne.org/fwknop/docs/SPA.html

An upgrade to port knocking is Single Packet Authorization [1]. It doesn’t suffer from the observability, and other, problems of port knocking. [1] https://www.cipherdyne.org/fwknop/

My go-to is fwnop (https://www.cipherdyne.org/fwknop/) which is actually similar to the OP’s thing but battle tested. Only downside is it’s not available on iOS, so recently I setup WireGuard for my iPad. And yes, ssh pubkey + fwnop + WireGuard + fail2ban is ridiculous overkill, but hey, it’s my homelab server. That’s how I learn this stuff.

Another really good option is single packet authorization. Which, again, a little more complex than port knocking but also another step up in security. https://www.cipherdyne.org/fwknop/docs/SPA.html

The design decisions that govern fwknop provide guidance on how fwknop is different from knockknock: http://www.cipherdyne.org/fwknop/docs/fwknop-tutorial.html#design

In case you were unaware and didn't just want to write your own, fwknop is an off the shelf tool to do the same. http://www.cipherdyne.org/fwknop/

Not with single packet authentication from fwknop http://www.cipherdyne.org/fwknop/docs/fwknop-tutorial.html#what-is-SPA

<shameless_plug> Check out fwknop, https://www.cipherdyne.org/fwknop/ It's one solution to this problem. Instead of answering with garbage, it allows for keeping the firewall closed/default drop stance. It's port knocking, but with real cryptography instead of just relying on hitting port numbers, and does it with just a single packet. </shameless_plug> Full disclosure: I'm one of the Fwknop devs.

Just like most similar tools, this lacks indices. For example, if you use ASGs (Auto Scaling Groups), all instances would have the same name tag, so, you need to be able to specify an index if there are multiple instances under the same name. Edit 1: Created an issue [0] already. Edit 2: Added a request [1] to integrate fwknop [2] for full automation and better security. [0]: https://github.com/mikery/ssh2ec2/issues/1 [1]: https://github.com/mikery/ssh2ec2/issues/2 [2]: http://www.cipherdyne.org/fwknop/

While not quite to the same level of obfuscation, your suggestion reminded me of this project: http://www.cipherdyne.org/fwknop/ Its essentially port knocking with a single encrypted packet. Haven't tried it (yet) myself but sounds interesting.

Exactly what fail2ban needed: a web UI for people to exploit. If I could eliminate any Linux service, it would probably be fail2ban. As an SSH security measure, it's more than useless. If your SSH credentials can be brute forced, that's the problem, and it's easy to fix. Fail2ban just gives somebody a way to lock you out of your own system or to pin a core on your system by overloading it. If you're trying to add security layers to SSH, here are some suggestions for doing so: * fwknop (http://www.cipherdyne.org/fwknop/) -- Single Packet Auth based on GPG * google_authenticator (https://code.google.com/p/google-authenticator/) -- PAM support for TOTP * knockknock (https://github.com/moxie0/knockknock) -- Single Packet Auth using symmetric encryption

Also check out fwknop[1] [1] http://www.cipherdyne.org/fwknop/

Additionally you could also use something like fwknop[1]. It opens the ssh port for your ip when you need it and closes it after a preset time has passed. [1]http://www.cipherdyne.org/fwknop/docs/faq.html#fwknop

Normally, mod_security parses incoming traffic and blocks suspicious activity based on third-party rules [1]. Since you're using Squid, you can monitor outgoing traffic instead. Malicious traffic would get dropped instead of being proxied. Since you control the source servers, you could tarpit and/or ban the user. Snort + Snortsam [2] or fwsnort [3] would do the same thing for non-HTTP traffic. [1] https://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_S… [2] http://www.snortsam.net [3] http://cipherdyne.org/fwsnort/

I knew someone would raise an issue there. If you're that concerned about security, there are a handful of additional things you can do: * Use a non-standard ssh port * Disable root ssh login * Configure 'Single Packet Authorization and Port Knocking' -- http://www.cipherdyne.org/fwknop/ * Have decent iptables rules. Use either fail2ban or denyhosts with stringent rules, if you must, that ban on 3+ failed logins. * Have a whitelist of acceptable IP's for ssh access * Use any system of 2-factor authentication. I'm partial to Google's Authenticator. Here're some directions to get that set up, if anyone is interested: http://guides.webbynode.com/articles/security/ubuntu-google-authentica… But seriously, if you have keys set up and someone manages to steal them... you've really got bigger things you should be focusing on.

The risk reduction is negligible if someone is doing a portscan on your host. Connection attempts to non standard ports will eventually occur. The better solution is to use single packet authorization.[1] 1. http://cipherdyne.org/fwknop/