<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body text="#FFFFFF" bgcolor="#000000">
<div class="moz-cite-prefix">On 10/03/2014 12:11 AM,
<a class="moz-txt-link-abbreviated" href="mailto:centos-docs-request@centos.org">centos-docs-request@centos.org</a> wrote:<br>
</div>
<blockquote
cite="mid:mailman.2871.1412309483.799.centos-docs@centos.org"
type="cite">
<pre wrap="">Send CentOS-docs mailing list submissions to
<a class="moz-txt-link-abbreviated" href="mailto:centos-docs@centos.org">centos-docs@centos.org</a>
To subscribe or unsubscribe via the World Wide Web, visit
<a class="moz-txt-link-freetext" href="http://lists.centos.org/mailman/listinfo/centos-docs">http://lists.centos.org/mailman/listinfo/centos-docs</a>
or, via email, send a message with subject or body 'help' to
<a class="moz-txt-link-abbreviated" href="mailto:centos-docs-request@centos.org">centos-docs-request@centos.org</a>
You can reach the person managing the list at
<a class="moz-txt-link-abbreviated" href="mailto:centos-docs-owner@centos.org">centos-docs-owner@centos.org</a>
When replying, please edit your Subject line so it is more specific
than "Re: Contents of CentOS-docs digest..."
Today's Topics:
1. Securing SSH --> Change ports (Theodor Sigurjon Andresson)
2. Re: Securing SSH --> Change ports (Karsten Wade)
3. Re: Securing SSH --> Change ports (Theodor Sigurjon Andresson)
4. Re: Securing SSH --> Change ports (PJ Welsh)
5. Re: Securing SSH --> Change ports (Theodor Sigurjon Andresson)
6. Re: Securing SSH --> Change ports (Manuel Wolfshant)
----------------------------------------------------------------------
Message: 1
Date: Thu, 2 Oct 2014 22:45:29 +0000
From: Theodor Sigurjon Andresson <a class="moz-txt-link-rfc2396E" href="mailto:TheodorSiAn@kvenno.is"><TheodorSiAn@kvenno.is></a>
To: <a class="moz-txt-link-rfc2396E" href="mailto:centos-docs@centos.org">"centos-docs@centos.org"</a> <a class="moz-txt-link-rfc2396E" href="mailto:centos-docs@centos.org"><centos-docs@centos.org></a>
Subject: [CentOS-docs] Securing SSH --> Change ports
Message-ID: <9C6DB64A0CF97645A5C90525A4C4C0CC0512C494@CRONUS>
Content-Type: text/plain; charset="us-ascii"
In there you are almost telling people that security through obscurity is a good way.
That might sometimes be true but in this case it could mean that you would be handing passwords and other data out.
When you start SSH on port 22 it is done with root privileges because the root user is the only one that can use ports below 1024. Root is the only user that can listen to that port or do something with it. If you move the port to 2222 for example you move SSH to a port that can be used with out a privileged user. This would mean I could write a script that listens to port 2222 and mimics SSH to capture the passwords. Changing the port of SSH to 2222 or anything above 1024 makes SSH less secure. Pretty ironic that this is in the "Securing SSH" chapter. This should never be done.
Location: <a class="moz-txt-link-freetext" href="http://wiki.centos.org/HowTos/Network/SecuringSSH#head-3579222198adaf43a3ecbdc438ebce74da40d8ec">http://wiki.centos.org/HowTos/Network/SecuringSSH#head-3579222198adaf43a3ecbdc438ebce74da40d8ec</a>
username: TheodorAndresson
------------------------------
Message: 2
Date: Thu, 02 Oct 2014 15:49:59 -0700
From: Karsten Wade <a class="moz-txt-link-rfc2396E" href="mailto:kwade@redhat.com"><kwade@redhat.com></a>
To: <a class="moz-txt-link-abbreviated" href="mailto:centos-docs@centos.org">centos-docs@centos.org</a>
Subject: Re: [CentOS-docs] Securing SSH --> Change ports
Message-ID: <a class="moz-txt-link-rfc2396E" href="mailto:542DD697.3000308@redhat.com"><542DD697.3000308@redhat.com></a>
Content-Type: text/plain; charset=windows-1252
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 10/02/2014 03:45 PM, Theodor Sigurjon Andresson wrote:
</pre>
<blockquote type="cite">
<pre wrap="">In there you are almost telling people that security through
obscurity is a good way. That might sometimes be true but in this
case it could mean that you would be handing passwords and other
data out.
When you start SSH on port 22 it is done with root privileges
because the root user is the only one that can use ports below
1024. Root is the only user that can listen to that port or do
something with it. If you move the port to 2222 for example you
move SSH to a port that can be used with out a privileged user.
This would mean I could write a script that listens to port 2222
and mimics SSH to capture the passwords. Changing the port of SSH
to 2222 or anything above 1024 makes SSH less secure. Pretty ironic
that this is in the "Securing SSH" chapter. This should never be
done.
Location:
<a class="moz-txt-link-freetext" href="http://wiki.centos.org/HowTos/Network/SecuringSSH#head-3579222198adaf43a3ecbdc438ebce74da40d8ec">http://wiki.centos.org/HowTos/Network/SecuringSSH#head-3579222198adaf43a3ecbdc438ebce74da40d8ec</a>
</pre>
</blockquote>
<pre wrap="">username: TheodorAndresson
</pre>
<blockquote type="cite">
<pre wrap="">
_______________________________________________ CentOS-docs mailing
list <a class="moz-txt-link-abbreviated" href="mailto:CentOS-docs@centos.org">CentOS-docs@centos.org</a>
<a class="moz-txt-link-freetext" href="http://lists.centos.org/mailman/listinfo/centos-docs">http://lists.centos.org/mailman/listinfo/centos-docs</a>
</pre>
</blockquote>
<pre wrap="">
What do you think about using a privileged but unassigned port such as
101?
- - Karsten
- --
Karsten 'quaid' Wade .^\ CentOS Doer of Stuff
<a class="moz-txt-link-freetext" href="http://TheOpenSourceWay.org">http://TheOpenSourceWay.org</a> \ <a class="moz-txt-link-freetext" href="http://community.redhat.com">http://community.redhat.com</a>
@quaid (identi.ca/twitter/IRC) \v' gpg: AD0E0C41
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iEYEARECAAYFAlQt1pcACgkQ2ZIOBq0ODEEpMACeMdWaOLnXlwJNzKKGjhGopviq
TVkAoJXSaHTe/7PmdAEhzzmSjkzL02es
=y+y6
-----END PGP SIGNATURE-----
------------------------------
Message: 3
Date: Thu, 2 Oct 2014 23:47:56 +0000
From: Theodor Sigurjon Andresson <a class="moz-txt-link-rfc2396E" href="mailto:TheodorSiAn@kvenno.is"><TheodorSiAn@kvenno.is></a>
To: Mail list for wiki articles <a class="moz-txt-link-rfc2396E" href="mailto:centos-docs@centos.org"><centos-docs@centos.org></a>
Subject: Re: [CentOS-docs] Securing SSH --> Change ports
Message-ID: <9C6DB64A0CF97645A5C90525A4C4C0CC0512C4BF@CRONUS>
Content-Type: text/plain; charset="us-ascii"
To change it to unassigned privileged port would be a much better idea if the user insists on changing it. I personally don't like the idea of security through obscurity at all.
However if I remember correctly there are some programs that depend on SSH to be run on port 22. Usually easily changed but sometimes it can't be. I might be wrong though.
________________________________________
From: <a class="moz-txt-link-abbreviated" href="mailto:centos-docs-bounces@centos.org">centos-docs-bounces@centos.org</a> [<a class="moz-txt-link-abbreviated" href="mailto:centos-docs-bounces@centos.org">centos-docs-bounces@centos.org</a>] on behalf of Karsten Wade [<a class="moz-txt-link-abbreviated" href="mailto:kwade@redhat.com">kwade@redhat.com</a>]
Sent: Thursday, October 02, 2014 22:49
To: <a class="moz-txt-link-abbreviated" href="mailto:centos-docs@centos.org">centos-docs@centos.org</a>
Subject: Re: [CentOS-docs] Securing SSH --> Change ports
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 10/02/2014 03:45 PM, Theodor Sigurjon Andresson wrote:
</pre>
<blockquote type="cite">
<pre wrap="">In there you are almost telling people that security through
obscurity is a good way. That might sometimes be true but in this
case it could mean that you would be handing passwords and other
data out.
When you start SSH on port 22 it is done with root privileges
because the root user is the only one that can use ports below
1024. Root is the only user that can listen to that port or do
something with it. If you move the port to 2222 for example you
move SSH to a port that can be used with out a privileged user.
This would mean I could write a script that listens to port 2222
and mimics SSH to capture the passwords. Changing the port of SSH
to 2222 or anything above 1024 makes SSH less secure. Pretty ironic
that this is in the "Securing SSH" chapter. This should never be
done.
Location:
<a class="moz-txt-link-freetext" href="http://wiki.centos.org/HowTos/Network/SecuringSSH#head-3579222198adaf43a3ecbdc438ebce74da40d8ec">http://wiki.centos.org/HowTos/Network/SecuringSSH#head-3579222198adaf43a3ecbdc438ebce74da40d8ec</a>
</pre>
</blockquote>
<pre wrap="">username: TheodorAndresson
</pre>
<blockquote type="cite">
<pre wrap="">
_______________________________________________ CentOS-docs mailing
list <a class="moz-txt-link-abbreviated" href="mailto:CentOS-docs@centos.org">CentOS-docs@centos.org</a>
<a class="moz-txt-link-freetext" href="http://lists.centos.org/mailman/listinfo/centos-docs">http://lists.centos.org/mailman/listinfo/centos-docs</a>
</pre>
</blockquote>
<pre wrap="">
What do you think about using a privileged but unassigned port such as
101?
- - Karsten
- --
Karsten 'quaid' Wade .^\ CentOS Doer of Stuff
<a class="moz-txt-link-freetext" href="http://TheOpenSourceWay.org">http://TheOpenSourceWay.org</a> \ <a class="moz-txt-link-freetext" href="http://community.redhat.com">http://community.redhat.com</a>
@quaid (identi.ca/twitter/IRC) \v' gpg: AD0E0C41
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iEYEARECAAYFAlQt1pcACgkQ2ZIOBq0ODEEpMACeMdWaOLnXlwJNzKKGjhGopviq
TVkAoJXSaHTe/7PmdAEhzzmSjkzL02es
=y+y6
-----END PGP SIGNATURE-----
_______________________________________________
CentOS-docs mailing list
<a class="moz-txt-link-abbreviated" href="mailto:CentOS-docs@centos.org">CentOS-docs@centos.org</a>
<a class="moz-txt-link-freetext" href="http://lists.centos.org/mailman/listinfo/centos-docs">http://lists.centos.org/mailman/listinfo/centos-docs</a>
------------------------------
Message: 4
Date: Thu, 2 Oct 2014 18:49:37 -0500
From: PJ Welsh <a class="moz-txt-link-rfc2396E" href="mailto:pjwelsh@gmail.com"><pjwelsh@gmail.com></a>
To: Mail list for wiki articles <a class="moz-txt-link-rfc2396E" href="mailto:centos-docs@centos.org"><centos-docs@centos.org></a>
Subject: Re: [CentOS-docs] Securing SSH --> Change ports
Message-ID:
<a class="moz-txt-link-rfc2396E" href="mailto:CAMGrxtEbcfRn3SiWi29OZ_nBH82y_b1_7A_QvpmHYXpER68mrw@mail.gmail.com"><CAMGrxtEbcfRn3SiWi29OZ_nBH82y_b1_7A_QvpmHYXpER68mrw@mail.gmail.com></a>
Content-Type: text/plain; charset="utf-8"
The context for ssh !22 is about what others could/would do to a ssh
daemon. This includes script kiddies or some zero day exploit trolling for
*easy* targets. If you have someone creating a listener on the server, you
have an entirely different issue. How often do you randomly connect to some
system on port 2222 and provide *your* username and password? I am *not*
saying security through obscurity = security, but many IDS/IPS/anti-port
scanners will begin defensive actions when you plow through ports looking
for ssh connection. So instead of being an easier 1 port script kiddie
target you *layer* defenses (including possible STO). Basically anything to
slow down or deter or prevent an attack is good IMHO.
Just my 2cents of course.
pjwelsh
On Thu, Oct 2, 2014 at 5:45 PM, Theodor Sigurjon Andresson <
<a class="moz-txt-link-abbreviated" href="mailto:TheodorSiAn@kvenno.is">TheodorSiAn@kvenno.is</a>> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">In there you are almost telling people that security through obscurity is
a good way.
That might sometimes be true but in this case it could mean that you would
be handing passwords and other data out.
When you start SSH on port 22 it is done with root privileges because the
root user is the only one that can use ports below 1024. Root is the only
user that can listen to that port or do something with it. If you move the
port to 2222 for example you move SSH to a port that can be used with out a
privileged user. This would mean I could write a script that listens to
port 2222 and mimics SSH to capture the passwords. Changing the port of SSH
to 2222 or anything above 1024 makes SSH less secure. Pretty ironic that
this is in the "Securing SSH" chapter. This should never be done.
Location:
<a class="moz-txt-link-freetext" href="http://wiki.centos.org/HowTos/Network/SecuringSSH#head-3579222198adaf43a3ecbdc438ebce74da40d8ec">http://wiki.centos.org/HowTos/Network/SecuringSSH#head-3579222198adaf43a3ecbdc438ebce74da40d8ec</a>
username: TheodorAndresson
_______________________________________________
CentOS-docs mailing list
<a class="moz-txt-link-abbreviated" href="mailto:CentOS-docs@centos.org">CentOS-docs@centos.org</a>
<a class="moz-txt-link-freetext" href="http://lists.centos.org/mailman/listinfo/centos-docs">http://lists.centos.org/mailman/listinfo/centos-docs</a>
</pre>
</blockquote>
<pre wrap="">-------------- next part --------------
An HTML attachment was scrubbed...
URL: <a class="moz-txt-link-rfc2396E" href="http://lists.centos.org/pipermail/centos-docs/attachments/20141002/b47fb1a0/attachment-0001.html"><http://lists.centos.org/pipermail/centos-docs/attachments/20141002/b47fb1a0/attachment-0001.html></a>
------------------------------
Message: 5
Date: Fri, 3 Oct 2014 01:17:09 +0000
From: Theodor Sigurjon Andresson <a class="moz-txt-link-rfc2396E" href="mailto:TheodorSiAn@kvenno.is"><TheodorSiAn@kvenno.is></a>
To: Mail list for wiki articles <a class="moz-txt-link-rfc2396E" href="mailto:centos-docs@centos.org"><centos-docs@centos.org></a>
Subject: Re: [CentOS-docs] Securing SSH --> Change ports
Message-ID: <9C6DB64A0CF97645A5C90525A4C4C0CC0512C4DF@CRONUS>
Content-Type: text/plain; charset="us-ascii"
Yes, when securing your services you *layer* defenses that could include using STO. But when STO is set up in a wrong way it can lead to a security issue. It isn't good to protect your services to slow down or prevent an attack by opening up a security risk. As in this case changing the port of SSH to 2222 isn't a good way to include STO. It doesn't matter how big the risk is, you just don't want this issue to be there. If you want to include STO in your security measures then you have to do it without opening up a security risk because you might be opening up a security risk that could be dangerous. In my opinion that is the case with SSH to port 2222. Changing the port to an privileged unassigned or unused port is a better way to include STO in your security measures for SSH. That way you don't have the risk of another user listening on your SSH.
________________________________________
From: <a class="moz-txt-link-abbreviated" href="mailto:centos-docs-bounces@centos.org">centos-docs-bounces@centos.org</a> [<a class="moz-txt-link-abbreviated" href="mailto:centos-docs-bounces@centos.org">centos-docs-bounces@centos.org</a>] on behalf of PJ Welsh [<a class="moz-txt-link-abbreviated" href="mailto:pjwelsh@gmail.com">pjwelsh@gmail.com</a>]
Sent: Thursday, October 02, 2014 23:49
To: Mail list for wiki articles
Subject: Re: [CentOS-docs] Securing SSH --> Change ports
The context for ssh !22 is about what others could/would do to a ssh daemon. This includes script kiddies or some zero day exploit trolling for *easy* targets. If you have someone creating a listener on the server, you have an entirely different issue. How often do you randomly connect to some system on port 2222 and provide *your* username and password? I am *not* saying security through obscurity = security, but many IDS/IPS/anti-port scanners will begin defensive actions when you plow through ports looking for ssh connection. So instead of being an easier 1 port script kiddie target you *layer* defenses (including possible STO). Basically anything to slow down or deter or prevent an attack is good IMHO.
Just my 2cents of course.
pjwelsh
On Thu, Oct 2, 2014 at 5:45 PM, Theodor Sigurjon Andresson <<a class="moz-txt-link-abbreviated" href="mailto:TheodorSiAn@kvenno.is">TheodorSiAn@kvenno.is</a><a class="moz-txt-link-rfc2396E" href="mailto:TheodorSiAn@kvenno.is"><mailto:TheodorSiAn@kvenno.is></a>> wrote:
In there you are almost telling people that security through obscurity is a good way.
That might sometimes be true but in this case it could mean that you would be handing passwords and other data out.
When you start SSH on port 22 it is done with root privileges because the root user is the only one that can use ports below 1024. Root is the only user that can listen to that port or do something with it. If you move the port to 2222 for example you move SSH to a port that can be used with out a privileged user. This would mean I could write a script that listens to port 2222 and mimics SSH to capture the passwords. Changing the port of SSH to 2222 or anything above 1024 makes SSH less secure. Pretty ironic that this is in the "Securing SSH" chapter. This should never be done.
Location: <a class="moz-txt-link-freetext" href="http://wiki.centos.org/HowTos/Network/SecuringSSH#head-3579222198adaf43a3ecbdc438ebce74da40d8ec">http://wiki.centos.org/HowTos/Network/SecuringSSH#head-3579222198adaf43a3ecbdc438ebce74da40d8ec</a>
username: TheodorAndresson
_______________________________________________
CentOS-docs mailing list
<a class="moz-txt-link-abbreviated" href="mailto:CentOS-docs@centos.org">CentOS-docs@centos.org</a><a class="moz-txt-link-rfc2396E" href="mailto:CentOS-docs@centos.org"><mailto:CentOS-docs@centos.org></a>
<a class="moz-txt-link-freetext" href="http://lists.centos.org/mailman/listinfo/centos-docs">http://lists.centos.org/mailman/listinfo/centos-docs</a>
------------------------------
Message: 6
Date: Fri, 03 Oct 2014 07:11:15 +0300
From: Manuel Wolfshant <a class="moz-txt-link-rfc2396E" href="mailto:wolfy@nobugconsulting.ro"><wolfy@nobugconsulting.ro></a>
To: Mail list for wiki articles <a class="moz-txt-link-rfc2396E" href="mailto:centos-docs@centos.org"><centos-docs@centos.org></a>
Subject: Re: [CentOS-docs] Securing SSH --> Change ports
Message-ID: <a class="moz-txt-link-rfc2396E" href="mailto:542E21E3.1030209@nobugconsulting.ro"><542E21E3.1030209@nobugconsulting.ro></a>
Content-Type: text/plain; charset="iso-8859-1"; Format="flowed"
On 10/03/2014 04:17 AM, Theodor Sigurjon Andresson wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Yes, when securing your services you*layer* defenses that could include using STO. But when STO is set up in a wrong way it can lead to a security issue. It isn't good to protect your services to slow down or prevent an attack by opening up a security risk. As in this case changing the port of SSH to 2222 isn't a good way to include STO. It doesn't matter how big the risk is, you just don't want this issue to be there. If you want to include STO in your security measures then you have to do it without opening up a security risk because you might be opening up a security risk that could be dangerous. In my opinion that is the case with SSH to port 2222. Changing the port to an privileged unassigned or unused port is a better way to include STO in your security measures for SSH. That way you don't have the risk of another user listening on your SSH.
</pre>
</blockquote>
<pre wrap="">I agree with you on two things
- changing the default port is not a security measure, it just lowers
the noise in the logs and takes you a bit out of the path of automated
scripts looking for easy targets.
- changing the default port to anything above 1024 creates a greater
risk than using one below 1024
On the other hand, even if it's easier to start a rouge daemon
impersonating sshd to listen on a higher port, if you have a malevolent
user already sniffing on a port - any port - from my point of view you
already have bigger issues than the potential risk you mentioned.
Incidentally I am a fan of using iptables (recent match) to limit the
number of admissible attempts from any given IP to connect to sshd (
yes, I know, it has nothing to do with the initial concern you raised )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <a class="moz-txt-link-rfc2396E" href="http://lists.centos.org/pipermail/centos-docs/attachments/20141003/03f5a957/attachment.html"><http://lists.centos.org/pipermail/centos-docs/attachments/20141003/03f5a957/attachment.html></a>
------------------------------
_______________________________________________
CentOS-docs mailing list
<a class="moz-txt-link-abbreviated" href="mailto:CentOS-docs@centos.org">CentOS-docs@centos.org</a>
<a class="moz-txt-link-freetext" href="http://lists.centos.org/mailman/listinfo/centos-docs">http://lists.centos.org/mailman/listinfo/centos-docs</a>
End of CentOS-docs Digest, Vol 95, Issue 2
******************************************
</pre>
</blockquote>
i think the rate limiting section sucks too... it should instead be
suggesting sshguard which can ban multiple failed login attempts for
variable amounts of time. i have mine set to ban for a week.
fail2ban can do the same for passwords but you can stream keys to
it. -666threesixes666<br>
</body>
</html>