forwarding port 22 safe? reddit / selfhosted ---------------------------------------------------------------------- 1c34 · 2023-11-28 19:23 i want to remotely ssh to my home server, and I was wondering if I could just forward port 22 with disabling password login and use pubkey authentication will be safe enough? ---------------------------------------------------------------------- gentooxativa · 2023-11-28 19:32 Is always better to randomize your ssh port, you will be safe from some scans ---------------------------------------------------------------------- Bloodrose_GW2 · 2023-11-28 19:39 Better use some kind of VPN and only open the SSH port over the VPN interface. ---------------------------------------------------------------------- mrpink57 · 2023-11-28 19:44 No. Just VPN in and SSH in. ---------------------------------------------------------------------- brandontaylor1 · 2023-11-28 19:44 As long as password auth is disabled you’re fine. No one is cracking your RSA key. You can add Fail2Ban to reduce the log noise, but security wise it’s fine. ---------------------------------------------------------------------- chaplin2 · 2023-11-28 19:44 If you disable password authentication, and use public key authentication, yes. ---------------------------------------------------------------------- AnApexBread · 2023-11-28 19:49 >disabling password login and use pubkey authentication will be safe enough? Just make sure you actually disable password login. Simply enabling key doesn't disable password. So as long as the password is disabled then you're fine. ---------------------------------------------------------------------- AnApexBread · 2023-11-28 19:49 >Better use some kind of VPN and only open the SSH port over the VPN interface. Why? SSH is just as secure as your Wireguard service. ---------------------------------------------------------------------- Bloodrose_GW2 · 2023-11-28 19:50 Because the SSH service/daemon can also have exploits (happened multiple times). ---------------------------------------------------------------------- tehdon · 2023-11-28 19:51 As long as password auth is disabled you're PROBABLY fine. If there are any exploits that crop up for the version of sshd that you're running then you could get nailed with a pre-auth exploit like a malformed packet exploit of the like. Changing the port number won't remediate an sshd vulnerability, but it will make it less likely that you'll be targeted by the ongoing onslaught of ssh scans. ---------------------------------------------------------------------- AnApexBread · 2023-11-28 19:56 >Because the SSH service/daemon can also have exploits (happened multiple times). And your VPN can't? >Edit: and when you use something like Tailscale, you don't even need to run a public facing service on your systems themselves. And someone can't break into your Tailscale account? ---------------------------------------------------------------------- InevitableArm3462 · 2023-11-28 19:57 I recommend implementing a VPN (wireguard is working very well for me) and through that do ssh ---------------------------------------------------------------------- boxcorsair · 2023-11-28 19:58 Likely better behind a VPN. This was reported recently. https://thehackernews.com/2023/11/experts-uncover-passive-method- to.html?m=1 ---------------------------------------------------------------------- kaipee · 2023-11-28 19:59 How is a VPN service more secure than an SSH service? Both accept login. Both provide can be brute forced / if using password. ---------------------------------------------------------------------- Bloodrose_GW2 · 2023-11-28 20:00 Important to understand that there are ZERO absolutely risk-free solutions. You are weighing probabilities. A simpler application usually have less exploits or vulnerabilities, while a complex system like sshd, had multiple ones already. Wireguard is quite simple and straightforward, with a pretty good track record, for one. But even if it does get compromised, it's an additional layer that needs to be broken e.g. there are chances that if your VPN gets compromised, your sshd won't or the attacker has less time to get in because you notice the break-in. ---------------------------------------------------------------------- kaipee · 2023-11-28 20:03 Disable password auth. Enable key only auth. Add in TOTP 2FA (google authenticator). Randomize the port (reduce bots) that forwards to 22. Configure lockout to block upon 3 failed attempts, for a long duration like 1 year. (Have a backup access on LAN). Ensure only the highest encryption ciphers are accepted. Ensure upgrades are applied to sshd at least monthly. ---------------------------------------------------------------------- razorpolar · 2023-11-28 20:03 The chances of someone exploiting an SSH with password authentication disabled is incredibly slim (even in a highly targeted effort) but a VPN like Wireguard is still more secure - Wireguard doesn't advertise itself and won't even respond to packets unless a request contained the correct keys, there's nothing to really exploit. ---------------------------------------------------------------------- foomatic999 · 2023-11-28 20:03 Using a non-standard port for SSH doesn't make it safer but it *greatly* reduces noise in your logs. If you only use it yourself, change the port. ---------------------------------------------------------------------- mshorey81 · 2023-11-28 20:03 Most likely it's fine. Though it's not terribly difficult to set up some flavor of VPN so you're not exposing 22 at all outside your network. Personally I use Wireguard. ---------------------------------------------------------------------- Swanners · 2023-11-28 20:04 I would not do this, people port scan all the time and thats an easy one to look for. Try using an at home vpn like openvpn or in the very least change the ssh port to something odd like 6854 or whatever. ---------------------------------------------------------------------- mrpink57 · 2023-11-28 20:12 What VPN service to your home do you use that uses a password to authenticate? ---------------------------------------------------------------------- brandontaylor1 · 2023-11-28 20:20 That’s fair, but from what I can tell it’s possible on 1:1,000,000 keys, and only if the ssh server is five years out of date. In their study they were able to recover 4,900 keys from the 5.2 Billion they tested, and all of them were bad hardware implantations that were years out of date. The paper also reveled that it could be used on IPsec traffic which includes most VPNs I will concede that it’s marginally riskier, but it’s not a significant risk, or really a reasonable concern. Especially when all you’re protecting is your Plex server. Like most vulnerabilities the best protection is regular updates. ---------------------------------------------------------------------- ddpbsd · 2023-11-28 20:24 I ran passwordless ssh on the internet for a long time and didn’t have issues. I stopped recently on my home network. Instead I have a wireguard tunnel to a vps. I can ssh into the vps (ssh keys only, and I use a hardware token) or wireguard into it from the road. ---------------------------------------------------------------------- Bloodrose_GW2 · 2023-11-28 20:26 > when all you’re protecting is your Plex server You're not just protecting your own server. If your server/network gets compromised, it will usually be used to hack other systems from, and could lead to inconvenient questions from the ISP or even law enforcement. ---------------------------------------------------------------------- kaipee · 2023-11-28 20:31 Many people will simply deploy OpenVPN thinking that solves the problem. In reality it just moves the problem ---------------------------------------------------------------------- AnApexBread · 2023-11-28 20:32 > Wireguard doesn't advertise itself and won't even respond to packets unless a request contained the correct keys, there's nothing to really exploit. Ahhh the good ol, Wireguard is invisible myth ---------------------------------------------------------------------- mrpink57 · 2023-11-28 20:32 OVPN will use keys and not a username password, I have yet to ever find a OVPN that will allow username/password and with or without 2fa. ---------------------------------------------------------------------- matticrisp · 2023-11-28 20:40 How does wireguard authentication work? Digital certificates, username/password or what? ---------------------------------------------------------------------- mrpink57 · 2023-11-28 20:41 A public and private cert that match. ---------------------------------------------------------------------- billiarddaddy · 2023-11-28 20:42 Move it to a four digit port on your router and port for to 22 internally. ---------------------------------------------------------------------- InfaSyn · 2023-11-28 21:09 With PubKey and Fail2Ban its probably ok but wouldnt chance it personally. Can you use a different port too? ---------------------------------------------------------------------- Human_Cartographer · 2023-11-28 21:12 +1 for Fail2ban. This is the way ---------------------------------------------------------------------- gnordli · 2023-11-28 21:17 If you are going all out, may as well add hosts.deny and hosts.allow. ---------------------------------------------------------------------- Ok_Size1748 · 2023-11-28 21:24 Port knocking could be useful here ---------------------------------------------------------------------- returnofblank · 2023-11-28 21:26 A VPN will always be better for this purpose, but as long as you properly secure your SSH server, shouldn't be a problem ---------------------------------------------------------------------- Best-Expert · 2023-11-28 21:29 Can you please explain more. ---------------------------------------------------------------------- ripnetuk · 2023-11-28 21:30 Because if ssh has a risk of 1 percent, and tailscale has a risk of 1 percent, the two together have a risk of 1 percent of one percent. ---------------------------------------------------------------------- PolicyArtistic8545 · 2023-11-28 21:31 Most of us aren’t businesses. Running older, 5+ year old hardware is what a lot of home users in the selfhosted/homelab communities do mostly due to cost. I would not be shocked if nation states don’t do this to get personal creds from company IT and tech workers and use that to pivot into their companies. Similar to lastpass. ---------------------------------------------------------------------- ripnetuk · 2023-11-28 21:32 I would risk it. After all, it's the only thing protecting my entire gitlab account. If someone could break my ssh, they could do what they want to my gitlab presence,and I'm guessing someone at gitlab is paid and qualified to make that call. ---------------------------------------------------------------------- dev_all_the_ops · 2023-11-28 21:43 Port forwarding will work, but it has major downsides 1. Will draw attention of bots 2. Secure as long as there are no security holes in openssh (which is rare but has happened) 3. You \_must\_ harden the ssh server by disabling password auth, putting behind fail2ban There are far better and safer alternatives that I would recommend over exposing a raw port to the world. 1. Tailscale 2. Wireguard/OpenVPN ---------------------------------------------------------------------- StarExplorerOne · 2023-11-28 21:51 Alternative to Fail2Ban: Crowdsec ---------------------------------------------------------------------- NotAMuritard · 2023-11-28 21:51 yes 4^2^0^69 seems to work fine ---------------------------------------------------------------------- Beastmind · 2023-11-28 21:59 Also don't use rsa, use Ed25519 nowadays ---------------------------------------------------------------------- kaipee · 2023-11-28 22:03 Easy to do with known internal networks. Difficult to manage when roaming. ---------------------------------------------------------------------- Hatta00 · 2023-11-28 22:05 Change your port. No one's cracking a proper implementation of RSA, but not every implementation is proper. A little obscurity can't hurt. ---------------------------------------------------------------------- no_step · 2023-11-28 22:11 Old hardware is fine, the point is not to run a five year old version of ssh ---------------------------------------------------------------------- Both-Following9917 · 2023-11-28 22:12 Get fail2ban setup at a minimum ---------------------------------------------------------------------- no_step · 2023-11-28 22:16 I run [this ](https://docs.linuxserver.io/images/docker-endlessh/) on port 22 and ssh with keys on a different port ---------------------------------------------------------------------- Hatta00 · 2023-11-28 22:23 Wireguard traffic is easily identified. If you know wireguard packets are being sent to a port, you can safely assume wireguard is listening on that port. Obfuscation is explicitly not a goal of the Wireguard project. ---------------------------------------------------------------------- pentesticals · 2023-11-28 22:41 Just waiting for everyone to come in saying you shouldn’t do this lol. Yes, changing the port is a nice little bonus. It doesn’t any extra security, but it moves you out of the way from the automated bots that scan the internet trying recent 0days. You’ll probably see a reduction of 99% traffic hitting the service and the only logs will be real people. ---------------------------------------------------------------------- pentesticals · 2023-11-28 22:45 You need to expose one secure service over another, it doesn’t really matter if you want that to be a VPN or SSH. Both are susceptible to vulnerabilities and misconfigurations. ---------------------------------------------------------------------- whopper2k · 2023-11-28 22:46 I disagree, this doesn't help anything in terms of security. Port scanners are not difficult to run (in fact usually that's step 0), and they'll still pick up services hosted on nonstandard ports. The only good thing that will come of it is fewer log entries of kiddies trying the most common ports; you'll still get entries from actors scanning every port and are still vulnerable to the various security issues around open ports. Obscurity can't hurt in most cases, but in this case it doesn't have a tangible benefit to your overall risk. Not to mention any applications that work via SSH w/ hardcoded ports. Stupid? Yes. But all software is stupid if you dig enough into it. ---------------------------------------------------------------------- Accomplished-Lack721 · 2023-11-28 22:48 Solution no. 2 generally involves exposing a port for the VPN, which itself could be compromised just as SSH could. But that's mostly fine, so long as the service behind the VPN is also using reasonable layer(s) of security themselves. ---------------------------------------------------------------------- Cylian91460 · 2023-11-28 22:50 Yes, but you should change the port ---------------------------------------------------------------------- gnordli · 2023-11-28 22:55 Absolutely, just sometimes people forget those tools even exist. Of course, you can easily do the same thing with firewall rules as well. Also, that was a great tidbit about the pam email notification on successful logon. I haven't seen that one before, thank you!! ---------------------------------------------------------------------- astronautcytoma · 2023-11-28 22:56 I have a port 22 ssh process that denies everything, and a separate ssh process on a different port that accepts logins as normal. So someone could obviously find the hidden one, but it won't be the apparently-functional one that they can hit day and night and never get any results from. ---------------------------------------------------------------------- Senkyou · 2023-11-28 23:05 Yeah, this is really the way to think about it. It doesn't matter which device on your network is compromised if it has access to devices with sensitive data. For example, I might keep Bank information or other sensitive documents on my personal laptop. If that's on the same flat network as my Plex server then who cares if my Plex server gets compromised. It's going to be used as a pivot point ---------------------------------------------------------------------- Internal-Initial-835 · 2023-11-28 23:14 In a word no. That’s not a port you want others sniffing around. Some isps actively block that port for security. IMHO a vpn is the best way. That way you get full access to your network as if you’re using a wired direct connection. You “can” use port 22 and you can make it pretty secure but I just wouldn’t feel safe directly exposing it when there are other ways. Imagine the access somebody could get if you do something slightly wrong or you miss a patch for a new vulnerability. Yep it’s unlikely but why risk it. Put it behind something on a none standard port rather than a port that every sniffer will poke at :) ---------------------------------------------------------------------- MattTheTable · 2023-11-28 23:16 It's literally one setting to change the port. Why keep it the same? ---------------------------------------------------------------------- Valcorb · 2023-11-28 23:17 Disable password, enable ssh key, enable 2fa, install a VPN and only allow ssh connections from the ips of your device on the vpn so only your phone (and computers) can access it. ---------------------------------------------------------------------- warysysadmin · 2023-11-28 23:23 I would also add twingate as an alternative. ---------------------------------------------------------------------- Internal-Initial-835 · 2023-11-28 23:28 Generally speaking. VPN is easier to setup securely out of the box for most especially with limited knowledge. You can choose a random port and then have access to any server on your network. Scanners won’t usually test all ports unless they find something that’s tempting. Normally just the normal ports will be poked including 22. SSH can be secured well but not without jumping through a few hoops. It’s easier imho to accidentally allow access through incorrect ssh setup than vpn. When you think vpn has been developed with this exact purpose in mind. It’s fair to assume the protection will be better out of the box. If you have a vpn then a hacker needs to get through the vpn and then also the ssh so there’s not really any disadvantage to using a vpn and then also harden ssh if you want to. It’s about making things difficult. Nobody is going to spend days or weeks battering a vpn if they don’t think there’s anything useful behind it. A VPN also shows somewhat that you’ve given things consideration and are not an easy target. Don’t get me wrong. If somebody is determined enough and has the resources then they will find a way but given the choice between an easy target and one that’s ever so slightly more difficult, they will almost always go for the easiest. ---------------------------------------------------------------------- uncmnsense · 2023-11-28 23:30 Rather than port forward 22, I would recommend using the ipv6 address and securing the host. ---------------------------------------------------------------------- ezpzCSGO · 2023-11-28 23:31 In my case, password auth disabled, changed port, fail2ban, and not exposing the port, I connect through vpn and then ssh, but in the end it's still an open port for the vpn ---------------------------------------------------------------------- Swanners · 2023-11-28 23:32 Fair enough. If you can run firewall rules then great. But opening up something like ssh to the internet is a risky risk. Cert auth is not a bad way to go in that scenario. ---------------------------------------------------------------------- BinniH · 2023-11-28 23:33 Set up free Tailscale and access your server that way. ---------------------------------------------------------------------- mcr1974 · 2023-11-28 23:40 but you still have to expose something to connect to wireguard? ---------------------------------------------------------------------- mcr1974 · 2023-11-28 23:43 so same as a public / private rsa key ---------------------------------------------------------------------- mcr1974 · 2023-11-28 23:45 what would the way be anyway? they can only dos you. ---------------------------------------------------------------------- fprof · 2023-11-28 23:45 Yes ---------------------------------------------------------------------- mrpink57 · 2023-11-28 23:47 correct, you can also add a pre-shared key on top of that, that key is supposed to be quantum computer proof (future). ---------------------------------------------------------------------- jerwong · 2023-11-28 23:49 Yes, it's perfectly safe. Keep it patched, use strong ciphers, use key authentication, and set up an IDS like Fail2Ban or CrowdSec. ---------------------------------------------------------------------- Oujii · 2023-11-28 23:58 > only logs will be real people. There are bots that scan for open ports in seconds. ---------------------------------------------------------------------- mshorey81 · 2023-11-29 00:09 Of course. But it's just another layer to the onion. Pfblockerng, Crowdsec, Fail2Ban, wireguard....layers. ---------------------------------------------------------------------- Innominate8 · 2023-11-29 00:31 A tremendous amount of cargo culting going on here. As long as your server is aggressively kept up to date and doesn't have any guessable passwords, exposing port 22 can be done safely. If you're not certain about these, you shouldn't. Fail2ban or changing your ssh port provides no additional security and only serves to reduce log noise at the risk of blocking actual users. A VPN makes no practical difference. ssh uses strong encryption just like the VPN. Sure you're hiding ssh, but the VPN provides an even greater attack potential surface. ---------------------------------------------------------------------- Karyo_Ten · 2023-11-29 00:32 But then it's blatantly obvious and you can behavior block. ---------------------------------------------------------------------- Innominate8 · 2023-11-29 00:37 1. The bots are looking anyways. 2. The other options being presented are various VPNs. OpenSSH has far more eyes on it, for much longer than any of the VPNs. Both generally run as root on the host and so have similar attack surfaces. 3. Disabling password auth is less important than having good passwords, but is still a good idea since turning off passwords guarantees no bad passwords. Fail2ban provides no security. ---------------------------------------------------------------------- Karyo_Ten · 2023-11-29 00:38 >Not to mention any applications that work via SSH w/ hardcoded ports. Stupid? Yes. But all software is stupid if you dig enough into it. What applications work with hardcoded SSH? SSH, sftp, rsync and scp all accept a port parameters and for the rest you can use an ssh tunnel. >in this case it doesn't have a tangible benefit to your overall risk. It has tangible benefits: - you can keep logs longer because less hits. Wouldn't be fun to be DOS-ed by your log size. - scanning every port is either blatantly obvious or need to be done over multiple days to work around behavior blocking, effectively rate- limiting suspicious actors. Security is layered. ---------------------------------------------------------------------- mcr1974 · 2023-11-29 00:38 but wouldn't you have to pay a performance penalty running ssh on top of wireguard. ---------------------------------------------------------------------- Karyo_Ten · 2023-11-29 00:44 Or your attack surface became 1 - 0.99 x 0.99 = 1.99% ---------------------------------------------------------------------- Karyo_Ten · 2023-11-29 00:51 >VPN is easier to setup securely out of the box for most especially with limited knowledge. One of the top audit companies disagrees with you: https://blog.trailofbits.com/2016/12/12/meet-algo-the-vpn-that-works/ ---------------------------------------------------------------------- mshorey81 · 2023-11-29 00:53 Negligible. Worth it to me to have an extra layer. ---------------------------------------------------------------------- astronautcytoma · 2023-11-29 00:53 I agree entirely. The box I have this on is my piddle-around server. A long time ago I used to administer a medium-sized cluster of Linux boxes and they were all cert auth, and I wouldn't have had it any other way. Mostly, I think it's fun to see what usernames and passwords the scripts and bots and hackers try on my neutered SSH. ---------------------------------------------------------------------- thefpspower · 2023-11-29 00:57 Yeah but they scan common ports otherwise it would take too long for each IP scan. They don't care about those that try to be secure, they care about the easy targets, unless you're a specific target. ---------------------------------------------------------------------- dev_all_the_ops · 2023-11-29 01:04 I haven’t heard of twingate, their documentation looks great. Thanks for sharing. ---------------------------------------------------------------------- senpaikcarter · 2023-11-29 01:05 You should look into a self hosted VPN instead 😉 ---------------------------------------------------------------------- DarthNihilus · 2023-11-29 01:20 Realistically no one is cracking my super long randomized password either. Seems fine to leave it on as backup login. ---------------------------------------------------------------------- thuhstog · 2023-11-29 01:30 not all use a known port list, some scan all ports, the assumption is if the target is relying on obscurity then they probably aren't very secure. ---------------------------------------------------------------------- mcr1974 · 2023-11-29 01:51 neglegible.. how much? ---------------------------------------------------------------------- mshorey81 · 2023-11-29 01:52 Not enough to warrant not having it for my use cases. ---------------------------------------------------------------------- mcr1974 · 2023-11-29 01:55 fair, for your use cases. was wondering about mine. if its 10 percent I might start thinking.. latency as well. ---------------------------------------------------------------------- ayoungblood84 · 2023-11-29 02:06 I wouldn't open up 22 to the world. I would change the port at a minimum or use a VPN. ---------------------------------------------------------------------- nefarious_bumpps · 2023-11-29 02:09 >Yeah but they scan common ports otherwise it would take too long for each IP scan. > >They don't care about those that try to be secure, they care about the easy targets, unless you're a specific target. [shodan.io](https://shodan.io) just lol'd and left the chat. ---------------------------------------------------------------------- nefarious_bumpps · 2023-11-29 02:10 Apparently, the downvoters don't understand IPS. ---------------------------------------------------------------------- SR_Lut3t1um · 2023-11-29 02:12 For aure someone will use an unknown ssh exploit just to get into YOUR system. Lets be real no one is hosting stuff worth more than 10.000.000 and said exploit would easily be woth that amount. Just check for updates DAILY and you'll be fine. ---------------------------------------------------------------------- repocin · 2023-11-29 02:13 ipv6 is great, if not for the fact that many ISPs around the world still haven't bothered rolling it out decades later. ---------------------------------------------------------------------- SR_Lut3t1um · 2023-11-29 02:16 Dont connect it to the internet too. Chances are even less likely that some navy seals kinda guys will steal you data with brute force. Also always keep explosives next to your hdds so once they do come you can explode them. ---------------------------------------------------------------------- blackstar2043 · 2023-11-29 02:31 To help with identifying issues with your SSHd configuration, I recommend using ssh-audit: https://github.com/jtesta/ssh-audit ---------------------------------------------------------------------- ennova2005 · 2023-11-29 02:35 Good summaries. How does the TOTP 2FA article handle drop/reconnects? TOTP needed for each reconnect attempt? ---------------------------------------------------------------------- imthefrizzlefry · 2023-11-29 02:38 Using an alternate port will drastically cut down on the number of people trying to brute force your server ---------------------------------------------------------------------- kihaji · 2023-11-29 02:41 > If you're not certain about these, you shouldn't. If someone is asking random assholes on the internet if they should do something, I'm guessing the answer to this is no. ---------------------------------------------------------------------- blusls · 2023-11-29 02:59 Depending on how you will be connecting depends on how you should configure this. I would strongly suggest just setting up a Wireguard server and connect to it via VPN. At the same time, exposing the port and using a pubkey with Fail2Ban would be the next best option, while always keeping your server patched. These are the simplest ways to do this and still be secure. Again, I strongly suggest setting up a private VPN of your choosing. WireGuard Installs - [https://www.wireguard.com/install/](https://www. wireguard.com/install/) WireGuard Docker - [https://github.com/wg-easy/wg- easy](https://github.com/wg-easy/wg-easy) ---------------------------------------------------------------------- upofadown · 2023-11-29 03:05 RSA is fine. It isn't like you will have to worry about the length of the keys for SSH. ---------------------------------------------------------------------- jcollie · 2023-11-29 03:13 Someone *will* use a SSH exploit to get into *every* SSH server, including yours. You may not have been specifically targeted but you'll be attacked because they can. If for nothing else other than to be a base to launch other attacks or run crypto mining or whatever. ---------------------------------------------------------------------- HkQJ97DSGUCehF · 2023-11-29 03:21 Ignorance like this is how you end up in someone's botnet. ---------------------------------------------------------------------- davis-andrew · 2023-11-29 03:28 The benefit of wireguard^ is it runs over udp and won't respond unless a peer with the right key hits it. ie a port scan won't reveal anything because there's no tcp port open to handshake, and wireguard won't respond to junk data coming in. ^ Most VPNs run over udp. But i'm not sure say OpenVPN will respond to random crap, it probably won't but i don't want to state categorically that it won't. ---------------------------------------------------------------------- tanjera · 2023-11-29 03:57 Part forwarding opens an attack surface- whatever service you're exposing is the "attack surface" so make sure it's secure. >disabling password login This is absolutely a very strong/good hardening first-step. >pubkey authentication Hell yeah. Very strong. Just keep that key safe (don't post it on the Internet, put it somewhere insecure or public, etc. Also recommended to password protect the key for extra safety. Additional steps you could take if you were worried: two-factor authentication, usually easy to setup and effective. Fail2ban or other IP blockers, takes more work and setup. Rate-limiting is a basic feature most ssh services have (e.g. more than 3 failed attempts = 5 minute lockout). But honestly keys-only, IMHO, is the safest 👍 ---------------------------------------------------------------------- s3r3ng · 2023-11-29 03:58 First of all don't expose a machine on your LAN unless it is very well locked down especially with respect to ability to access rest of LAN. To simply access home LAN set up home VPN that has the access instead of opening up a port as powerful as ssh. If you open ssh then put it at some other port than the well known 22 and make it accessible by authorized key only. I would further limit where this ssh can be accessed from using firewall rules. ---------------------------------------------------------------------- dal8moc · 2023-11-29 04:23 Which is easily defeated by using one block of ip addresses to gather data and another block for actually trying to exploit found ports. Unless you block the whole AS. If the attacker only uses one system with one ip they probably wouldn’t have the resources to get past ssh anyway. ---------------------------------------------------------------------- Karyo_Ten · 2023-11-29 04:29 Behavior blocking can be done across many IPs. If you have one IP that scans port 10000, the other port 10001, thousands of IPs scanning just 1 port it's still blatantly obvious. And if they want to scan in a less obvious manner they need to do this spaced by days. ---------------------------------------------------------------------- dal8moc · 2023-11-29 04:38 Ok. I wasn’t aware of that. Especially as the port probing I see on my firewall isn’t simply ascending or descending pretty numbers. But then again I’m not managing professional equipment. Thanks for the explanation! ---------------------------------------------------------------------- highedutechsup · 2023-11-29 04:57 no ---------------------------------------------------------------------- JB1712 · 2023-11-29 04:57 Should be safe enough to do this but I’ll throw in one potential caveat. Say that you one day somehow need to troubleshoot your ssh server and have to re-enable password authentication. Depending on how many other services you plan to run, it can be easy to suddenly forget you have port 22 exposed on the outside and someone could potentially break in if you use a weak password. This is why I personally host only necessary https content over port 443 to the world. I host anything else so only my wireguard vpn can access it. As for bots hitting port 22 on the outside can be another huge problem. Changing the port can disuade some but remember that the port number is only two bytes in size. A comprehensive port scan only takes a very short amount of time to complete. This, in my humble opinion, creates an extra point of access for you to remember for not that much to gain. That all being said, forwarding key protected ssh is safe enough to do. ---------------------------------------------------------------------- ManifestFailure · 2023-11-29 05:19 Exactly this. Just because you are a "small target" doesn't mean you are safe from an automated script. Take a look at shodan.io, you can see a lot of fancy information from it. ---------------------------------------------------------------------- OCTS-Toronto · 2023-11-29 05:35 Thats old tech, you should upgrade to Ed209 https://www.google.com/url ?q=https://m.youtube.com/watch%3Fv%3DTYsulVXpgYg&sa=U&ved=2ahUKEwj5pru 9veiCAxXgg4kEHU9rB-4QtwJ6BAgJEAE&usg=AOvVaw2Pab3xuFSTcSnppRGOFc8U ---------------------------------------------------------------------- mshriver2 · 2023-11-29 05:47 If you really want security you should also add UFW and restrict it to only your IP address. ---------------------------------------------------------------------- pentesticals · 2023-11-29 06:10 Yes but most bots are scanning for common ports. It’s far too slow to scan 65k ports on every host. Even things like shodan only scan a handful of common ports. But you can test this yourself, expose SSH on a port number in 20-40ks, I’ve seen several weeks without a single probe. If you’ve ever done mass scanning you know that’s minutes is not going to to be a full scan and if you are trying to do 65k ports in a few minutes, your results will not be accurate. ---------------------------------------------------------------------- pentesticals · 2023-11-29 06:11 You literally just proved his point lol, shodan only scans like 15 ports. ---------------------------------------------------------------------- speculatrix · 2023-11-29 07:13 I've opened port 22 to specific IPv4 addresses, like my employer's, friends and family. For any other IPv4 origin, its best to set up a VPN. It's trivial to set up wireguard. You're probably safe to open port 22 for IPv6, as the address space is unfeasibly large to be scanned, but still, the secops in me doesn't like security by obscurity, so *I* don't. Also, there's evidence that hackers use things like IPv6 access logs on NTP to find accessible devices to target. ---------------------------------------------------------------------- speculatrix · 2023-11-29 07:18 Old hardware may have drivers that are unsupported and insecure. This kind of thing. https://www.phoronix.com/news/Linux-WiFi-Malicious-Packets That said, it's unlikely a hacker won't already be in your network if they're exploiting driver vulnerabilities. ---------------------------------------------------------------------- Sekhen · 2023-11-29 07:23 Wireguard doesn't answer unless you hand shake with a valid package. There are three 512 bit keys. And you can put ssh behind it with ssh keys. The extra later of defence is quite significant. No "actual user" is blocked by fail2ban. They auth with keys, can't really fail. Blocking after three fail is very reasonable and effective. It also keeps the logs noise down. ---------------------------------------------------------------------- Sekhen · 2023-11-29 07:24 Why not both? ---------------------------------------------------------------------- Gabe_Isko · 2023-11-29 07:29 Honestly? Would not recommend it. Probably no one breaking in soon, but there are just constantly tons of botnets portscanning 22 over the whole IP range. You should at least think of switching ports, but I usually recommend at least having a vpn for ssh. ---------------------------------------------------------------------- mr_whats_it_to_you · 2023-11-29 07:33 Well it‘s true that one can use RSA, which is still save with keys big enough, but if someone wants so save some extra computing power and time ed25519 is the way to go. ---------------------------------------------------------------------- eirsik · 2023-11-29 07:44 SSH exposed with key auth and not password is fine. It is the exact purpose of SSH after all. Also there are milions of web servers out there with exposed SSH because a lot of their users prefer to work with SSH and CLI instead of a web UI. Big hosts such as GoDaddy, BlueHost, Hostgate and so on, all expose their SSH. You don't see their servers crash and burn every week. ---------------------------------------------------------------------- Z80Fan · 2023-11-29 07:47 > If you know wireguard packets are being sent to a port And what about if you don't know? ---------------------------------------------------------------------- Prof-Mmaa · 2023-11-29 08:02 I keep ssh on port 80, multiplexed with usual HTTP traffic thanks to [sslh](https://github.com/yrutschle/sslh). Basically it's a protocol switchboard what detects what kind of traffic reaches your server and forwards it to appropriate service. It can distinguish between SSH/HTTP/OpenVPN and a few more. Pros? Security wise probably nothing more that SSH already offers, but port 80 is rarely (if ever) blocked on other networks and having SSH on port that is non-standard and obscured, cuts way down on random attempts to guess the user/password combination. ---------------------------------------------------------------------- betahost · 2023-11-29 08:04 Or use something like Tailscale.com, secure private mesh vpn. No need to expose any ports. ---------------------------------------------------------------------- sdR-h0m13 · 2023-11-29 08:04 WireGuard uses UDP and will not respond if the attacker doesn't have the correct key. So the port used by WG will appears as a close port. ---------------------------------------------------------------------- dumbasPL · 2023-11-29 08:16 The difference is extremely tiny because asymmetric encryption is only used at the very beginning to securely establish a symmetric key that will be used for everything else afterwards. So you would have to be running this on a smart fridge to notice the speed difference. ---------------------------------------------------------------------- dumbasPL · 2023-11-29 08:28 Well, this line of thinking could be applied to literally anything, including your firewall or VPN server. While I agree that reducing the attack surface is a good thing, the only way to be 99% safe is to air- gap a machine. Imo some risks are acceptable, ssh being one of them. The ssh code (especially the pre-auth stuff) has been audited by so many people, corporations, and bad actors over the years that I myself feel pretty confident about it. ---------------------------------------------------------------------- Internal-Initial-835 · 2023-11-29 08:39 That’s talking about commercial vpns which isn’t what we’re talking about here. We’re not looking to be anonymous on the web which is what “good” commercial vpns offer. We’re looking for a way to securely access a home network from outside. Whilst both are vpns, they both are used differently. ---------------------------------------------------------------------- Internal-Initial-835 · 2023-11-29 08:46 A “top” audit company pushing their own agenda. OpenVPN is simple and easy to deploy on any major operating system. Pfsense or similar is easy to setup and run in a VM. That does all the hard work for you and creates a profile. Then you essentially copy or download that profile to the client machine and you’re done. It’s all done via gui or web interface so is easier for a lot of people. My sister managed it. She wouldn’t have been able to handle command line stuff. Like i said before though. Why not use a vpn and also harden your ssh. I can’t see a downside to that. It’s just my opinion and experience from working with both. You’re welcome to dissagree and do your own thing though of course :) ---------------------------------------------------------------------- Karyo_Ten · 2023-11-29 09:00 >A “top” audit company pushing their own agenda. It's all open-source. There is no agenda there. >My sister managed it. She wouldn’t have been able to handle command line stuff. There are plenty of tutorials to deploy Algo on say a Digital Ocean $5 droplet Also to quote them on OpenVPN > OpenVPN: Requires client software > OpenVPN’s lack of out-of-the-box client support on any major desktop or mobile operating system introduces unnecessary complexity. The user experience suffers. > Speaking of users, they’re required to update and maintain this software too. That is a recipe for disaster. > Worst of all, OpenVPN depends on the security of TLS, both the protocol and its implementations. Between that, and past security incidents, we simply trust it less. ---------------------------------------------------------------------- Scruffy-Nerd · 2023-11-29 09:15 I think many ppl are missing a step here. Setup a VPN with wireguard or similar. Then in ur sshd configs only allow ssh from ur VPN local subnet. That on top of ssh key login is pretty secure. Unless one of ur other services gets compromised and they pivot to ur VPN network. Then u prob have more problems tbh ---------------------------------------------------------------------- mcr1974 · 2023-11-29 09:28 thank you for the explanation. ---------------------------------------------------------------------- SR_Lut3t1um · 2023-11-29 10:33 No. Use a firewall, disable password and root login. Again its very unlikely someone uses an unknown openssh exploit to get into your system. These unknown exploits are valuable and they aren't used on small targets as every usage will increase the risk of detection. Use an unknown exploit to create a botnet and the exploit will be known within minutes maybe 1-2 hours. Use it to target specific targets and you may be able to infiltrate their whole infrastructure if you chain the exploits. Again if you check for updates DAILY you're gonne be fine, however keep in mind Docker containers need systemupdates too. ---------------------------------------------------------------------- SR_Lut3t1um · 2023-11-29 10:34 No as again, these exploits are extremely valuable and doing that would make the exploit known within minutes. ---------------------------------------------------------------------- Internal-Initial-835 · 2023-11-29 10:40 Yes you’ve quoted them. It’s not the experience I’ve had personally though and I’ve been around a while. I’ve used OpenVPN on windows, Linux, iOS and android. Hassle free. Super simple server side setup too. Like I said, even my sister who’s not a tech person managed it. No additional costs or cloud stuff needed which also will increase overheads when you consider ALL your traffic will go through that server. The $5 droplet isn’t going to go very far. I’m not sure id want to introduce added costs, complexities or points of failure when there’s no need. How many regular people can follow the guides they offer where it’s all command line? I’ve never heard of that company. Would I trust what they say? Should I trust and blindly follow their guides if I don’t understand what they’re doing? I’d say probably not but you do you. OpenVPN or wireguard have never let me down. I trust them with sensitive data and have no issues recommending to my clients. If the likes of pfsense are happy with OpenVPN in their firewalls I think that says a lot. They wouldn’t support something that could bring them bad publicity. Security holes on a firewall product wouldn’t be a good look. ---------------------------------------------------------------------- daYMAN007 · 2023-11-29 10:49 I wouldn't be surprised if 50% of the users on this sub are salesman for vpn's or cloudflare ---------------------------------------------------------------------- blackstar2043 · 2023-11-29 11:07 This is my current hardened sshd configuration. **ssh/sshd_config**: https://pastebin.com/7tH36TdJ * Public key authentication and 2fa using oathtool are used to authenticate. * Logging in is only possible for members of the 'ssh-user' group. * The "root" login is disabled through "PermitRootLogin", "DenyGroups", and "DenyUsers". * "restricted" has the ability to log in from any host. * "user" is limited to using the internal network to log in. * 'admin' can only log in when connected via WireGuard. * "sftp" may login, but only uses the sftp server. There is no shell available. **pam.d/sshd**: https://pastebin.com/eqkisf4F * All successful pre-2FA logins will trigger the'ssh-login-alert', which sends an NTFY alert containing the time, date, user, and host IP. * The use of /etc/users.deny prevents root login. * The use of /etc/users.allowed permits login by "restricted", "user", "admin" * 2FA and ssh-login-alert trigger do not apply to "sftp" ---------------------------------------------------------------------- GolemancerVekk · 2023-11-29 11:21 https://arstechnica.com/security/2023/11/hackers-can-steal-ssh- cryptographic-keys-in-new-cutting-edge-attack/ ---------------------------------------------------------------------- GolemancerVekk · 2023-11-29 11:28 > Yeah but they scan common ports otherwise it would take too long for each IP scan. It takes less than half a second to send SYN's to all 65k ports on one host and a few seconds to get a response from the open ports and figure out what protocols they use. It's ridiculously easy and fast to figure out open ports. ---------------------------------------------------------------------- ripnetuk · 2023-11-29 11:32 This assumes that you can attack both at once, and getting past either is sufficient to get in. In reality, they are layered, so you have to defeat one before even attempting the other. Otherwise, I could reduce the security on YOUR ssh server by simply proxying my connection to it through one or more insecure relays (telnet anyone???) ---------------------------------------------------------------------- Karyo_Ten · 2023-11-29 11:37 >No additional costs or cloud stuff needed which also will increase overheads when you consider ALL your traffic will go through that server. The $5 droplet isn’t going to go very far. I’m not sure id want to introduce added costs, complexities or points of failure when there’s no need. That's an example, you can deploy it yourself. >How many regular people can follow the guides they offer where it’s all command line? I’ve never heard of that company. Would I trust what they say? Should I trust and blindly follow their guides if I don’t understand what they’re doing? I’d say probably not but you do you. They are a serious security company, see their contributions: https://github.com/trailofbits/publications They also reviewed very sensitive projects like Hashicorp, cURL, Terraform or OpenVPN, see https://github.com/trailofbits/publications/ blob/master/reviews/2022-12-openvpn-openvpn2-securityreview.pdf >OpenVPN or wireguard have never let me down. I trust them with sensitive data and have no issues recommending to my clients. They used wireguard, they found issues in OpenVPN when **hired** by OpenVPN to audit them. >If the likes of pfsense are happy with OpenVPN in their firewalls I think that says a lot. They wouldn’t support something that could bring them bad publicity. Security holes on a firewall product wouldn’t be a good look. The people behind algo were hired by OpenVPN to poke holes into it. ---------------------------------------------------------------------- mr_whats_it_to_you · 2023-11-29 11:40 True enough ---------------------------------------------------------------------- TacticalGodMode · 2023-11-29 11:55 Bit its by far less common. Simplybecause you can either scan all ports of 1 target or one common port on 65k targets. And its not relying on obscurity. Its using this very easy thing to add an extra layer of security. And those who are able to change ports and disable passwort auth are at least somewhat capable of security, and didnt just copy paste a dockerfile without even changing the password. ---------------------------------------------------------------------- Internal-Initial-835 · 2023-11-29 12:07 So these guys poked holes in OpenVPN. Surely that only served to improve OpenVPN? I can’t imagine when shown flaws or holes OpenVPN didn’t fix them. Also. Who did they hire to poke holes in their own product algo? Are we supposed to just believe their product is perfect and above reproach? I’m not saying also isn’t worth a look. It’s just not something I would personally trust having used OpenVPN and other similar products for many years without a single issue. I’m by no means an expert but I can say that not one of my installs has been compromised and I’ve setup a fair few. Maybe I’m just lucky but more likely it’s the products doing what they’re supposed to when setup how they should be. Everybody is entitled to their opinions for sure and I respect yours to use algo and trust your sensitive data to it but I just couldn’t. ---------------------------------------------------------------------- upofadown · 2023-11-29 12:25 Requires an actual hardware error. Almost all implementations, including all open source SSH implementations, check that the signature is valid thus preventing a cosmic ray induced bit flip from triggering this issue and any related issue. What effect do hardware errors have on Ed25519? ---------------------------------------------------------------------- upofadown · 2023-11-29 12:28 Last I looked, RSA was faster for signature verification and encryption. Slower for signature generation, decryption and key generation. So it depends. ---------------------------------------------------------------------- Budget-Supermarket70 · 2023-11-29 12:47 It all BS if your a target there is probably nothing you can do to stop it. And if you move the port you stopped 99% of the scanning. ---------------------------------------------------------------------- Budget-Supermarket70 · 2023-11-29 12:52 So your saying a nation state is hacking home labers to maybe get info for business? Don't think so they are not wasting zero days on a maybe we well get access. Most people are not important enough for targeted attacks and well just be random scans happening hoping to get something. ---------------------------------------------------------------------- Budget-Supermarket70 · 2023-11-29 12:53 Thats why I store thermite by my rack. Burns it all down. ---------------------------------------------------------------------- Budget-Supermarket70 · 2023-11-29 12:57 Sure seems like it. Oh you can only do this it is the only way to be safe. Well if your targeted by a nation state good luck probably almost no way to be safe. And if your a random nobody then nobody cares enough. Sure you'll be scanned and if something found exploited but that's just the junk always flying around the net. ---------------------------------------------------------------------- Kazer67 · 2023-11-29 13:00 Add port knocking, if we go all out, let's go all out! ---------------------------------------------------------------------- Karyo_Ten · 2023-11-29 13:10 >So these guys poked holes in OpenVPN. Surely that only served to improve OpenVPN? I can’t imagine when shown flaws or holes OpenVPN didn’t fix them. Well yes they were hired by OpenVPN team to find vulnerabilities so the OpenVPN team can fix them. >Also. Who did they hire to poke holes in their own product algo? Are we supposed to just believe their product is perfect and above reproach? Their product is a configuration of wireguard with highest security standard. It's open-source. And it's security experts that implemented them. You're not supposed to believe, you can verify yourself. Note that a security issue in a company that sells security would cost them reputation and subsequently millions in contracts. They have a vested interest to make sure that what they put out there is solid. >I’m by no means an expert but I can say that not one of my installs has been compromised and I’ve setup a fair few. They are experts. And they have seen thousands of installs including those that were actually targeted and failed. See also https://en.m.wikipedia.org/wiki/Argument_from_anecdote >Maybe I’m just lucky but more likely it’s the products doing what they’re supposed to when setup how they should be. Unless you've installed thousands of VPN for high-value targets, it's more likely that your VPN was deemed not worth any attacker time. ---------------------------------------------------------------------- PolicyArtistic8545 · 2023-11-29 13:20 Past data refutes your claim. ---------------------------------------------------------------------- gandazgul · 2023-11-29 13:29 Yes 💯 to everything in this list. I have it open like this and haven't had issues so far. If you open 22 itself you will immediately get robots trying to brute force with dictionaries. A different port will take longer and be less activity overall. The banning for 3 fails takes care of a lot of it though. ---------------------------------------------------------------------- gandazgul · 2023-11-29 13:30 Related to this. Does anyone know of a way to open a tunnel from Android? ---------------------------------------------------------------------- ayoungblood84 · 2023-11-29 14:17 With a VPN there's no need to change the port. Unless you change all of your ssh ports to another set pretty across all of your hosts, you're just asking for a headache at scale. ---------------------------------------------------------------------- Sekhen · 2023-11-29 15:04 I have a "prep script" that takes care of everything. It takes less than 2 minutes to run on a fresh install and does all kind of fun things. ---------------------------------------------------------------------- Innominate8 · 2023-11-29 16:57 I think its just cargo culting. VPNs are way too often treated as a panacea for security, even when they're just serving as an extra unnecessary layer of encryption. ---------------------------------------------------------------------- SamSausages · 2023-11-29 17:09 Yes and no. Yes if you have the resources to monitor and update. Companies have entire teams dedicated to this. No if you don't have the resources/time to keep up with it regularly. IMO, no need to take this risk when you have services like Tailscale available today. ---------------------------------------------------------------------- Beastmind · 2023-11-29 17:57 It is but if you're going to use something security related, use the current recommendation unless you stricly can't for legacy reason or something. ---------------------------------------------------------------------- sidusnare · 2023-11-29 18:39 >Configure lockout to block upon 3 failed attempts fail2ban ---------------------------------------------------------------------- noselike · 2023-11-29 18:45 Personally I'd probably go for something like a cloudflare tunnel or a wireguard server on a virtual server somewhere and just not expose any ports from my home network to the internet at all. But that's at least partly because I'd want to use more than just SSH from remote if I started down that path and the attack surface gets pretty large if you're trying to make things convenient. ---------------------------------------------------------------------- SR_Lut3t1um · 2023-11-29 19:02 Judging by how paranoid everyone in this sub here is, that's not enough (btw. indeed it isn't). It's best to use oversized explosives. Termite may only burn through a small hole leaving the rest intact. ---------------------------------------------------------------------- gnordli · 2023-11-29 19:06 Of course, nice add. ---------------------------------------------------------------------- thuhstog · 2023-11-29 19:38 Try publishing an RDP server on port 3390 instead of 3389 see how much longer before a botnet finds you, and starts using NLbrute to force their way in. I mean you shouldn't do that, and most companies now put RDP servers behind a VPN, or have dumped RDP for other solutions. ---------------------------------------------------------------------- jcollie · 2023-11-29 20:05 You don't get it. Yeah, if someone's got a magic iPhone exploit that will get fixed immediately as soon as it's used you only need to worry about it if you're some high value target. But there are many many more exploits that even once they are known by the "good guys" take a long time to develop a patch and EVEN LONGER for that patch to be deployed. Take for instance the recent Cisco IOS-XE web server vulnerability. 20,000 routers (at least) were compromised before Cisco even knew it was happening. That's a scale that had to be automated, and by deploying it Cisco discovered the exploit. That's the essence of "0-day" vulnerabilities - they are discovered by the good guys because the bad guys already know about them and are actively exploiting vulnerable targets. ---------------------------------------------------------------------- SR_Lut3t1um · 2023-11-29 20:12 You take you system offline if a 0 day explot exists. You aren't going to be safe just by changing the port. In fact my point is, its the least effective. Get a static ipv4 ad only allow your ip to access the ssh server. If you cant do that use hardening methods like those in red hats docs. Yes changing the port is part of it, but that because it doesnt harm to do and makes the setup a tini tidy bit more obscure. Its not like it enchanhes your security significantly. Thats my point. Its a tiny change helpen tiny bit. ---------------------------------------------------------------------- jcollie · 2023-11-29 20:17 How the hell are you supposed to know that there's a 0-day exploit on day -1????? The whole point of 0-day exploits is that the good guys don't know about it until systems start to be compromised. Yes, changing the port is helpful, but I'm challenging your assertion that you don't have to worry about being attacked just because you're a small fry. The automated bots don't care who you are and yes, they will "burn" an unknown exploit in automated attacks. ---------------------------------------------------------------------- SR_Lut3t1um · 2023-11-29 20:22 I never once said you don't have to worry about beeing attacked. I'm saying 0 day exploits should be the last of your worrys. Chances are your configuration is more likely having security flaws than openssh itself. Recommending to someone to change the port because of 0 day attacks as the first way to harden your system is just bad advice. There are way more important things to do first. That's why I'd recommend to setup a firewall get a static ip and only let your ip access openssh. That will be way more effective than just changing the port, as it also saves you from attacks because of a misconfigured openssh server. You will make mistakes more likely than openssh will, thats my whole point. ---------------------------------------------------------------------- upofadown · 2023-11-29 20:54 I think that legacy reason in this case would be already having RSA keys. The point is that you don't have to go through the bother of replacing them. ---------------------------------------------------------------------- marbonmb · 2023-11-29 23:06 I know that some VPN are able to create private networks for devices logged with your account. For exemple nordvpn is able to connect your devices into their "mesh network" and make your devices available through the VPN. I think it's better than exposing a ssh service on Internet, even with a lot of protections! ---------------------------------------------------------------------- xupetas · 2023-11-30 06:55 No!