#null_route — Public Fediverse posts

@b0rk @quixoticgeek

The ssh-copy-id command is very handy, and suffered a shortcoming until a few years back where it didn't easily accommodate servers listening on non-standard ports (port numbers other than 22). It's especially handy if you're working with more than a single key, and As far as I'm concerned, editing /etc/ssh/sshd_config so that your SSH server is listening on a non-standard port is actually standard operating procedure.

Today let's say your server is listening on port 51555. to add a (default) key you would invoke it like so:

~$ ssh-copy-id -p 51555 [email protected] - copies your default pubkey over.

It will initially ask you for your (b0rk's) password. If you don't supply the username it will use the logged in user. Following successful login, the magic happens, permissions are set and the public key is copied in to ~/.ssh/authorized_keys. The permissions that should be set are equivalent to:
~/.ssh (700)
~/.ssh/authorized_keys (600)

As soon as your public key is copied over, you're logged out and you are instructed to log in again. If you're using your SSH agent then you just see your shell prompt on the remote box after providing the passphrase for the key.

Since you probably had an id_rsa.pub or an id_ed25519.pub and you wanted to use your id_ecdsa.pub on the remote machine instead, then you probably want to alter your copy command to:

~$ ssh-copy-id -p 51555 -i ~/.ssh/id_ecdsa.pub [email protected]

The correct syntax in this instance is to have a space between `-p' and the actual port number, but in practice, whenever you login in the future you'll just enter:

b0rk@local_box:~$ ssh jvns.ca -p51555 (no space before the port number)

Taking this one step further, I recommend having an active trigger of some sort listening on port 22 that simply "null routes" hosts trying to knock on that door. I like null routes because it drops everything before the firewall, but at least use ipsets so you don't use up memory on maintaining huge lists of those who have scanned your machine for an open SSH port. People will recommend things like fail2ban or SSHGuard, but out of the box those are temporary bans and honestly, I'm just not that charitable with second chances towards people who scan for open ssh ports on my boxes.

I actually like to ban entire countries right off the bat, so you too may enjoy incorporating something like this.

#tallship #ipset #null_route #SSH

⛵