What are your concerns/policies regarding access to your ssh port?
Do you use only ssh keys? Do you use a jump server? Do you use a private vpn like wirguard/tailscale/zeroteir/etc?
I normally use ssh keys and allow ssh connections on non-standard ports from everywhere.
I've been testing tailscale and zerotier over the past few days, and they seem interesting, but when I reboot a server, the IP address becomes unreachable at random.
I didn't have time to dig deep into this issue and it could be faulty setup from my side!
What are your concerns/policies regarding access to your ssh port?
Do you use only ssh keys? Do you use a jump server? Do you use a private vpn like wirguard/tailscale/zeroteir/etc?
Thanks
All of the above. I have a Nebula between all my servers as well as my desktop and laptop so we can communicate with each other using keys. I have two hosts with password login + TOTP which act as jumphosts for when I'm not at my laptop/desktop ( or, uh, if I don't notice a key expiring in the nebula ).
With ssh port changed, I leave port 22 alive, to let CSF block the scanning bastards!
In stasis until the shitposting stops/abates.
Than=compare;then=sequence:brought=bring;bought=buy:staffs=pile of sticks:informations/infos=no plural. It wisnae me! A big boy done it and ran away. || NVMe2G for life! until death (the end is nigh).
keys only, standard port, no vpn, no jump box, no ip locking, fail2ban blocks persistent scanners. Maybe I should upgrade some of this but it hasn't been an issue afaict so far. For work boxes we are much more serious, but there are real admins running them too. Jump box istm works best if all your stuff is at a single provider like AWS, so you're less likely to have an outage at the jump host block all your stuff. Yes there are ways around that but it gets complicated.
Non-standard port, keys only, no root, raymii's cipherlist.eu, whitelist to two jumphosts on different providers. No whitelist when sshing via wireguard.
Never heard about a jump server BUT wouldn't that be putting all eggs in one basket? What happens if you forget to pay for your jump server or the IP gets changed?
RCLOUDSYSTEMS - EmailBackup and EmailSync are powerful email management and migration utilities for an unbeatable price!
Wrote a script which (cron) reads 'special' dns names and opens ports to them. Key access only and non standard port.
If I move around or an ip changes I update the dns and servers unblock.
Works really well.
non-standard yet privileged port to slim down the logs, then (as a general rule):
LogLevel VERBOSE
PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
TCPKeepAlive no
Compression no
a single IP may or may not be allowed in the firewall (personal VPN rather than jump hosts) but usually it's more convenient to allow every IPs (occasional scp or rsync between different boxes)
Non-standard port
No root login
No password
Fail2ban
Banning every IP that connects to port 22 twice in 10 minutes (twice, because I locked myself out once).
Changing the port number never made sense to me. I could easily just port scan the rest of your host to find a open SSH daemon on another port anyways. Unless you take the time to set up a firewall that has port scan blocking enabled.
Cheap dedis are my drug, and I'm too far gone to turn back.
Just be handsome & respectful and you can access all of my „ports“ whenever you like.
But seriously… In my case:
Disabled root login
Key based access only
Fail2Ban
Amitz, a very stable genius (it's true!) and Grand Rectumfier of the official LESLOS® (LES League of Shitposters).
Certified braindead since 1974 and still perfectly happy.
For multi-user/shared access stuff, generally non-standard port & enforcing key-based auth is good enough.
I have some shared hosting setups for friends/family/clients which needs pw auth so I'll do non-standard port + fairly aggressive fail2ban rules.
I've been getting a lot more firewall-happy in my old age though - the less that's exposed, the better, with how often zero days drop and things can get popped in an instant.
My DNS servers only need port 53 exposed publicly, so that's all that's open to the world. SSH, control panel ports, API endpoints, even IMAP/SMTP ports on some mail servers, etc can all be firewalled to a set of IPs I know I'll have access to (2 common IPs like my main VPNs, plus a cheap VM with a reliable provider).
For you guys that use Fail2Ban. I'm intrigued to know if you still see a lot of blocked brute force activity, and by 'a lot' I mean enough to warrant bothering with Fail2Ban.
I used to use it years ago when 'bashing down the door' style probes would actually slow the system noticeably and fill up auth logs, but these days all I see are low and slow probes from multiple IP addresses much of which would evade F2B anyway.
Sure the log files fill up a little bit, but without a performance/disk impact it doesn't seem worth worrying about if you've disabled password authentication.
I suspect a reason for that is modern probe tools probably take better notice of the 'Authentications that can continue: publickey' responses and go elsewhere if 'password' clearly isn't an option.
Just wondering if I'm lucky, as I haven't seen an impactful SSH probe in years, on a number of public facing servers.
@FAT32 said:
Port 22, Root login, Password only, Allow all IPs
#YOLO
not recommended?
who cares! Most people do it this way and don't have backups, then cry bc their data be gone, but once again WHO CARES LOLZ?
This can be considered good, as long as you use a very long and extremely complex password, preferably something generated by random.org or other randomization.
gentlemen, is this script recommended? if you use key-based access, which keys and which bit-lengths should you use? RSA/DSA/ECDSA/EdDSA SSH-1 (RSA)
In this line:
sed -i '/PasswordAuthentication/c\PasswordAuthentication no' $CONF_FILE
This command would match the following snippet in the default sshd_config content:
# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication. Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes
and change it to:
# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication. Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
PasswordAuthentication no
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes
which results in a non (human) readable paragraph.
I usually run this command instead:
sed -i -E '/#?PasswordAuthentication\b/ s|.*|PasswordAuthentication no|' /etc/ssh/sshd_config
My command only matches either a PasswordAuthentication directive or a commented directive starting with #PasswordAuthentication, not other occurrences within a longer comment line.
We accept Karma donations for the last flan. 🍮 affbrr
For now I'm using a jump server not for security propose, but because the logs are full of garbage with failed ssh attempts and it's hard to find anything useful in there.
Eventually I'll find a way to disable this failed attempts logging.
Comments
Jump Server (whitelisted) + non-standard SSH port + keys only
"The imitator dooms himself to hopeless mediocrity." — Ralph Waldo Emerson
Thank you:)
I normally use ssh keys and allow ssh connections on non-standard ports from everywhere.
I've been testing tailscale and zerotier over the past few days, and they seem interesting, but when I reboot a server, the IP address becomes unreachable at random.
I didn't have time to dig deep into this issue and it could be faulty setup from my side!
Well it depends on the environment and situation but that's how I do it.
Different people have different ways of doing things.
"The imitator dooms himself to hopeless mediocrity." — Ralph Waldo Emerson
That's perfect! I have a Jump Server for convenience too.
I usually just use OpenVPN, but have ssh open as well (checking the connecting IP against a few DNS RBLs).
Random port + ssh key login + disable root login
All of the above. I have a Nebula between all my servers as well as my desktop and laptop so we can communicate with each other using keys. I have two hosts with password login + TOTP which act as jumphosts for when I'm not at my laptop/desktop ( or, uh, if I don't notice a key expiring in the nebula ).
I normally just use SSH key, I do have a secondary method password with TOTP if am on a device that doesn't have the SSH key.
I normally lock the SSH ports to a couple of IPs and then SSH Keys everything. I do have a jump box too.
Can't be bothered with changing the port, so just block it instead
BillingServ - Easy, simple, and hassle-free online invoicing solution. Contact us today.
White Label VPN | Software Licensing Billing | WHMCS Alternative
With ssh port changed, I leave port 22 alive, to let CSF block the scanning bastards!
In stasis until the shitposting stops/abates.
Than=compare;then=sequence:brought=bring;bought=buy:staffs=pile of sticks:informations/infos=no plural.
It wisnae me! A big boy done it and ran away. || NVMe2G for life! until death (the end is nigh).
keys only, standard port, no vpn, no jump box, no ip locking, fail2ban blocks persistent scanners. Maybe I should upgrade some of this but it hasn't been an issue afaict so far. For work boxes we are much more serious, but there are real admins running them too. Jump box istm works best if all your stuff is at a single provider like AWS, so you're less likely to have an outage at the jump host block all your stuff. Yes there are ways around that but it gets complicated.
Non-standard port, keys only, no root, raymii's cipherlist.eu, whitelist to two jumphosts on different providers. No whitelist when sshing via wireguard.
Keeping a server completely offline is one way to secure a server.
♻ Amitz day is October 21.
♻ Join Nigh sect by adopting my avatar. Let us spread the joys of the end.
ticket #29387928... waiting for the provider reply to unplug the VPS energy cable
Changed port + only ssh key auth method + AllowUsers for me.
ServerStatus , slackvpn , linux mirrors
Recommended Providers: Servarica(aff) | HostBRR(aff) | SolidVPS(aff) | RackNerd(aff) | KuroIT(aff) | AlphaVPS(aff) | HostDare(aff)
I feel like this is a really personal question here. I mean who I let in my port is my business..
Tab Fitts | Founder/CEO - Spry Servers
SSD Shared Hosting || VPS || Dedicated Servers || Network Status || PHX1 LG || DAL1 LG || || AS398646 || 1-844-799-HOST (4678)
Indeed, a bit too personal to share.
♻ Amitz day is October 21.
♻ Join Nigh sect by adopting my avatar. Let us spread the joys of the end.
password, no jumpbox no nothing only maybe F2B worked wonderfully!
Synteq Technical Support, Technical Writer.
Contact me at: +1 (307) 428 8111 or [email protected]
I use different SSH port + port knocking + blacklisting everything that scans 22 + SSH keys on "root".
Cloudcone | Crunchbits | Dartnode | Dedirock | Georgedatacenter | Gigahost | Hostbilby | Host-c | Hostdzire | Hostsailor | Namecrane | Nuyek | Realtoxmedia | Servarica | Terabit | Tnahosting | Virmach
Never heard about a jump server BUT wouldn't that be putting all eggs in one basket? What happens if you forget to pay for your jump server or the IP gets changed?
RCLOUDSYSTEMS - EmailBackup and EmailSync are powerful email management and migration utilities for an unbeatable price!
Mentally strong people leaves SSH on port 22 where it belongs.
There's no firewall restriction.
Public key authentication required.
We accept Karma donations for the last flan. 🍮 affbrr
Wrote a script which (cron) reads 'special' dns names and opens ports to them. Key access only and non standard port.
If I move around or an ip changes I update the dns and servers unblock.
Works really well.
Get your FREE VPS if you develop Open Source software
Anyone uses tailscale.com?
Port 22, Root login, Password only, Allow all IPs
#YOLO
食之无味 弃之可惜 - Too arduous to relish, too wasteful to discard.
Password:
Hunter02[ IncogNET LLC ] - Since 2020
[ The Internet Speech & Privacy Company ]
Port 22, IPv6 only with public key auth
not recommended?
non-standard yet privileged port to slim down the logs, then (as a general rule):
LogLevel VERBOSE
PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
TCPKeepAlive no
Compression no
a single IP may or may not be allowed in the firewall (personal VPN rather than jump hosts) but usually it's more convenient to allow every IPs (occasional scp or rsync between different boxes)
who cares! Most people do it this way and don't have backups, then cry bc their data be gone, but once again WHO CARES LOLZ?
Synteq Technical Support, Technical Writer.
Contact me at: +1 (307) 428 8111 or [email protected]
https://mrpsycho.pl/cheatsheets/Bash-script-for-disabling-password-login/
Setting "UsePAM no" can have undesired effects at least on RH distros
Also, you'd prefer to pick a privileged port (<1024)
Non-standard port
No root login
No password
Fail2ban
Banning every IP that connects to port 22 twice in 10 minutes (twice, because I locked myself out once).
For me:
I find this is usually sufficient for most cases.
Changing the port number never made sense to me. I could easily just port scan the rest of your host to find a open SSH daemon on another port anyways. Unless you take the time to set up a firewall that has port scan blocking enabled.
Cheap dedis are my drug, and I'm too far gone to turn back.
Port 22, IPV4, Allow all IPs , Use Fail2ban to protect my machine.
My virtualized amusement park: https://github.com/oneclickvirt
Just be handsome & respectful and you can access all of my „ports“ whenever you like.
But seriously… In my case:
Disabled root login
Key based access only
Fail2Ban
Amitz, a very stable genius (it's true!) and Grand Rectumfier of the official LESLOS® (LES League of Shitposters).
Certified braindead since 1974 and still perfectly happy.
Depends on the server.
For multi-user/shared access stuff, generally non-standard port & enforcing key-based auth is good enough.
I have some shared hosting setups for friends/family/clients which needs pw auth so I'll do non-standard port + fairly aggressive fail2ban rules.
I've been getting a lot more firewall-happy in my old age though - the less that's exposed, the better, with how often zero days drop and things can get popped in an instant.
My DNS servers only need port 53 exposed publicly, so that's all that's open to the world. SSH, control panel ports, API endpoints, even IMAP/SMTP ports on some mail servers, etc can all be firewalled to a set of IPs I know I'll have access to (2 common IPs like my main VPNs, plus a cheap VM with a reliable provider).
🦍🍌
For you guys that use Fail2Ban. I'm intrigued to know if you still see a lot of blocked brute force activity, and by 'a lot' I mean enough to warrant bothering with Fail2Ban.
I used to use it years ago when 'bashing down the door' style probes would actually slow the system noticeably and fill up auth logs, but these days all I see are low and slow probes from multiple IP addresses much of which would evade F2B anyway.
Sure the log files fill up a little bit, but without a performance/disk impact it doesn't seem worth worrying about if you've disabled password authentication.
I suspect a reason for that is modern probe tools probably take better notice of the 'Authentications that can continue: publickey' responses and go elsewhere if 'password' clearly isn't an option.
Just wondering if I'm lucky, as I haven't seen an impactful SSH probe in years, on a number of public facing servers.
This can be considered good, as long as you use a very long and extremely complex password, preferably something generated by random.org or other randomization.
Cloudcone | Crunchbits | Dartnode | Dedirock | Georgedatacenter | Gigahost | Hostbilby | Host-c | Hostdzire | Hostsailor | Namecrane | Nuyek | Realtoxmedia | Servarica | Terabit | Tnahosting | Virmach
Non standard port. Pub key only. Disable password. Scanning won't do any harm.
gentlemen, is this script recommended? if you use key-based access, which keys and which bit-lengths should you use? RSA/DSA/ECDSA/EdDSA SSH-1 (RSA)
ED25519
Here is a nice article https://medium.com/risan/upgrade-your-ssh-key-to-ed25519-c6e8d60d3c54
Ed448 also good or only for paranoids?
The problem with ed25519 is that not everything supports it and it's annoying to have to support two keys.
how can you undo a key procedure that has been set up?
In this line:
This command would match the following snippet in the default sshd_config content:
and change it to:
which results in a non (human) readable paragraph.
I usually run this command instead:
My command only matches either a
PasswordAuthenticationdirective or a commented directive starting with#PasswordAuthentication, not other occurrences within a longer comment line.We accept Karma donations for the last flan. 🍮 affbrr
From active paranoia to complete carelessness..... This kind of thread is giving each of us a way to "belong"
Default port, root login, nopassword, sshguard.
I simply don't see how getting extra paranoid could get you any safer.
IMO sshd_config is pretty sane by default. All I need to change is:
I don't really care about port scanners anyway because modern cryptography keeps them away. But if you do, check out endlessh.
For now I'm using a jump server not for security propose, but because the logs are full of garbage with failed ssh attempts and it's hard to find anything useful in there.
Eventually I'll find a way to disable this failed attempts logging.