Hacker News Reader

Comment by mseebach | Hacker News Reader

Not being on port 22 raises the bar for getting into your server slightly, but as both the article and others here point out, you still get connections.

That means:

- If you have a guessable user name / password, you will still get hacked, and probably also by more determined people - which leads to:

- Those determined to get into your server will be delayed a few seconds, at most.

It's fine, do it, but only to get the bulk of the automated attacks out of your firewall / logs. If you're uncomfortable running SSH on port 22, your setup isn't safe enough, and switching ports is just putting a band-aid on an infected wound.

Hints:

- Root can't login from SSH. Use sudo.

- Public key only.

- If you have multiple servers, only one can accept SSH connections from the world. Preferably not in the same IP-subnet, much less domain, as any public facing server. Use this as gateway to other servers.

- IP whitelist, if practical.

View on HN

> raises the bar for getting into your server slightly,

Talking about bots/viruses/script kiddies and not targeted attacks. 18,000 to 5 is not what I would call slightly. In fact I would call it 4 orders of magnitude greater. Extremely greater.

There would be fewer hits on the port sure, but it wouldn't really raise the bar to getting in, which is the point he was trying to make.

Obviously, not all 18,000 of those attempts were going to succeed. Finding the port is the easy part.

If you can log in as account xyz over SSH, and account xyz has permission to do anything with sudo, how is that more secure than letting root log in over SSH?

If root can log in, the username is definitely known to the attacker and they must figure out the password. If root can't log in, the username of someone with an entry in sudoers probably isn't known to the attacker, so they must figure out both the username and password.

I do like this answer, but I'll also point out that making someone guess two strings is just as secure as making them guess one long string. If root has a random 10-char password, that's roughly the same number of guesses as a user's first name with an 8-char password.

Unless they can read the shadow file somehow, or a specific user attack vector makes it somewhat easier than complete guessing...

I'm not up to speed on security, but it appears to me that your sudo password should probably be different from your account password, so the scenario turns into figuring out the username and two passwords.

Is that even possible? I've never heard of anyone having a separate sudo password.

Yes. Here's how to set a separate sudo password:

Assume your primary user account is called "user".

Set up a second account, whose password you want to be your sudo password. Let's call this account "admin".

In /etc/sudoers:

  Defaults:user runas_default=admin
  Defaults:user runaspw

Now, as "user", you can

  sudo -u root whoami

and you will be asked for "admin"'s password.

The only downside is that "root" is no longer the default user to become, you have to explicitly specify it.

Hm... would the user not being in sudoers and using su with root password being different than the user password make more sense?

To log in via SSH, you (should) have a key, and a password for that key. To sudo on the server should require a different, complex password for the paranoid admin. (So 2 long passwords and a key to gain sudo priv's)

Reply on news.ycombinator.com