#sshd — Public Fediverse posts

I always remap my sshd daemon to listen to a non-standard port, to reduce a lot of noise. Which has worked fine for years. But every now and then there are attempts. All the #Linux kernel flaws found lately has made remote login attempts more interesting for attackers. And they scan much more broadly now than just port 22.

And that's why my second line of defence is to disallow remote root login - and also make use of the AllowGroups feature in sshd_config. Users granted remote access must be member of a specific group. And root is also excluded from this group.

That pays off these days. And this is a nice filter match for #fail2ban and similar tools

https://termbin.com/0cf6

I have 293 login attempts on "random users" since May 21. And 259 attempts as root.

#infosec #ssh #sshd #systemhardening #kernel

OK, normally I have my shit wired together, but this bastard is getting to me.

The requirement is for 'phishing-resistant' second factor. That rules out all of the six-digit code apps - it is too easy apparently to get someone to read out their codes to an attacker.

Again, IDK, but apparently 'phishing-resistant' is the next Big Thing. My personal feeling? We are chasing our shadows. Unless I am the last alive Iranian nuclear bloke, my login is as secure as I can be bothered to make it, and I am bound to be disappointed by a weakness at some point in the near or far future. Phishing isn't on the agenda.

Life.

I carry a seemingly-fine cryptographic store about with me most days and ludicrously call it my 'phone'. It can sign stuff, wrangle certificates, store passwords, read faces and fingerprints and QRcodes and NFC tags. Heaps of useful 'security' stuff. I wouldn't call the software environment _secure_ at all, but ... IDK, people seem happy enough with it. Anything for an easy life. Row with the flow.

So I search for:
"google passkey login with ssh"
My god, whatalottasloppa comes back. A gattling gun of half-arsery, cant and junk advice.
Then "MS hello for business login ssh". Christ almighty. Much worse. Worse again.
Then "Apple ID login to ssh". At least that seems to be a simple: "no". A relief really.

Someone in the know please: can I set up my sshd to use my phone-based passkey as a; primary, secondary or even the complete, login?

#TOTP #HOTP #passkey #sshd #key #certificates #PSK #login #ssh #linux #pam #openssh

The "magic" that makes this works seems to be pointing 'IdentityFile' to the public key, not the private. #sshd #ssh

Ya tengo listo el guión de un nuevo video para el canal de #YouTube de #juncotic, para el curso de Hardening y el de SSH!

Continuamos con lo que introduje en el video anterior: 2fa con TOTP en SSH usando google-authenticator y PAM.

Esta vez: mecanismos de recuperación si se nos cayó el celular/móvil al agua 😅

¿No viste el video anterior?

Te dejo el link para que te pongás al día 👇

https://youtu.be/QNeJ4a7powo

#2fa #totp #ssh #sshd #googleauthenticator #auth #pam #linux #infosec #ciberseguridad

Claramente no todo se puede hacer con #SSH 😜

Acá probando "sudo sshd -t" para verificar la sintaxis del archivo de configuración del servidor.

Se viene nuevo contenido en #JuncoTIC, se nota? 😉

#gnu #linux #openssh #sshd #humor #lol

Once there was https://blog.stribik.technology/2015/01/04/secure-secure-shell.html, which was fine. Now there is https://infosec.mozilla.org/guidelines/openssh, which doesn't include a date of the last update* (except perhaps the copyright 2017).

Where can I find current recommended SSH settings, with post-quantum and stuff?

* Oh, how I loathe websites that don't add the dates of creation and/or last update!

#ssh #sshd #sshd_config

As you can see the build process is smooth, the execution is blazingly fast. What more could I ask for?

https://smolbsd.org/

#programming #technology #BSD #netBSD #metaOS #microVM #networking #qemu #host #bmake #curl #sshd #Linux

The mighty world of BSD

Playing with again smolBSD, a fantastic metaOS system that I talked about a few weeks ago.
I'm a newbie, a greenhorn, when it comes to meta-operating systems built on top of NetBSD.

I am very eager to learn by doing, making mistakes in the process, correcting and feel the warmth of the BSD community, who is happy to correct, esp when I show that I read the docs after making the mistakes

The journey is fantastic, the learning process is fun. microVM's are amazing. I've registered 11ms boot times on this small machine with a few CPU cores (and 40GB RAM). The fun is endless

#programming #technology #BSD #netBSD #metaOS #microVM #networking #qemu #host #bmake #curl #sshd #Linux

https://smolbsd.org/

Monitoring my ssh connections on the SBC Pi5

the command used is this fuction

`function psgrep() { ps axuf | grep -v grep | grep "$@" -i --color=auto; }`

#networking #sshd #ssh #ps #grep #psgrep #OpenSource #POSIX

I've just had a nice experience playing with raspberry connect. Both ssh and vnc work smoothly

https://connect.raspberrypi.com/devices

#sshd #ssh #vnc #realvnc

#RaspberryPi #Pi5 #Debian #Linux #OpenSource #POSIX #micro #HDMI #Ventoy #ISO #manager #POST #microSD #ARM

Some how I am very envious of the 60MB RAM footprint while booting into a #linode #vps. The best I could get onto my #homelab is 300MB usage on a #Ubuntu cloud image. This is unfortunately the same as my desktop #ArchLinux with #KDE running.

The Ubuntu server image idled at 600MB RAM usage with #docker & #sshd. The culprits using most ram are #snapd & #multipathd.

@clacke Yes and no…
Instead of the overhead of containers, my 'jump' machines bind specific keys to the ssh commands that do the specifically authorized next hops and (where possible) restrict to specific client IPs. The OS of those machines are only accessible over a VPN or (for some VMs) a tightly secured web interface that has VNC over WebSockets inside a private network to their virtual consoles.

#infosec #bastion #jumphost
#ssh #sshd #OpenSSH

When you have an ssh jumphost, the trivial setup is one that conflates OS access and application access.

The application is ssh, providing the jump to the privileged network, but ssh also allows OS access, potentially allowing privilege escalation within the jumphost.

Are people taking this seriously and e.g. running an unprivileged sshd inside a container? Access the OS over port 22 to the privileged sshd, restricting that to the segregated admin network, access the jumping over port 2222 and minimize the attack surface on the outer host?

#infosec #bastion #jumphost
#ssh #sshd #OpenSSH

Who else got tripped up by the new security settings in sshd (openssh) recently?

* PerSourcePenalties
* PerSourcePenaltyExemptList

Anyone else notice that Android devices seem to trip these up specifically? Haven't dug into traces yet.

#Linux #ssh #openssh #sshd #Android

How does using the #Jolla #JollaC2 (@jolla) with #SailfishOS for about a week as a daily driver now (with my old #iPhone at home as a backup)?

In general, it works much better than I had hoped after my experiences with other alternative #smartphone systems and it indeed is the first (and so far only) system that indeed works quite well. Also at around 285€ (https://commerce.jolla.com/products/jolla-community-phone) it isn't too expensive, so one can simply try it out.

There are a few limitations though:

* I am really missing biometric unlocking
* There is no predictive text input, so typing could be more comfy
* The UX experience sometimes feels strange (but no no-gos for me)
* It is not a snappy and fast device
* Audio quality is so-so
* GPS really needs a GPS signal, so no WIFI-based location

What is great:

* It is a real #Linux, so it has a #terminal, #sshd, you can e.g. use the #Nix package manager etc.
* Android apps are running in a container
* You can have different users to limit data access

Unfortunately there are nearly no high-quality native apps so far and the built-in ones are very basic (e.g. email).

But: The #Android compatibility layer is very good, the system comes with #Fdroid and #AuroraStore (#Google store front-end) pre-installed, so you can easily install practically all official Android apps.

Most apps work very well, some (especially banking) apps do not though as they complain that the system is rooted, so YMMV regarding the apps you need.

In general I am really happy with this system.

And: All the de-ggoglefied Android phones like the #Volla will always still remain just that: A more limited Android. SailfishOS offers a path towards powerful native (#Qt/#QML/#Cplusplus/#Python/you name it) based apps.

I am hoping that Jolla will provide a significantly more powerful device option and that some of the problems above will be solved.

But already now, even with the limitations above, if you are somewhat technically inclined (but without the need to fiddle with a command line unlike with the open mobile Linux distributions), want to get rid of #Google or #Apple for whatever reason, want a #Linux #smartphone, support a #European company from #Finland, this phone is really usable.

I wish for `adhd_config` for brain just like `sshd_config` so that we can tweak it. #adhd #sshd

TIL of a deliberate source of Heisenbugs in the default sshd config:

MaxStartups 5:50:10

This means: Allow up to 5 simultaneous "starting" SSH connections. Between 5 and 10 starting connections, drop them randomly 50% of the time. Above 10: Do not allow any new SSH connections to start.

Took me a long time to diagnose why a particular combination of concurrent SSH processes would fail occasionally when connecting to this embedded machine.

https://www.simplified.guide/ssh/limit-simultaneous-connections

#sshd #ansible #swdev

So this happened:

Jan 30 03:07:16 skapet sshd-session[94311]: Failed password for invalid user "> from 165.231.182.56 port 15613 ssh2

I wonder if we are seeing a variant of "gropefor database down, feeding raw html to the ssh gropebot" scenario again such as in https://nxdomain.no/~peter/so_somebody_is_throwing_html_at_your_sshd.html #sshgropers #sshd #passwordguessing #passwordgroping #passwords #cybercrime

Today I did a writeup on a ssh client I love and adore. It's a cross platform (big 3) graphical client and I enjoy it as a replacement for WSL on windows and still give me a familiar view on Linux too.

But today's writeup was a bug report on the replaced ssh engine they put in the past week. Ssh keys are still broken for me and I discovered a few other things too along my investigation. It was a somewhat length dive for a github issue, but I hope it is well received, especially if it helps fix more issues.
#ssh #linux #sshd #github #opensource

Ah ouais !!! 🤔
80.67.164.12
2001.910.1400.115.12
@yunohost ça me surprend de voir ça 🤔

#fail2ban #Postfix #sshd #security #SSH #Hacker

And again it was an "include" in the sshd_config that caused some trouble. Still impressive how fast the bad login attempts accumulate on a fresh ip.

#ssh #sshd

Meine Welt verschiebt sich gerade von „error: beginning MaxStartups throttling“ zu „error: send_error: write: Broken pipe“. #sshd #anekdotischeEvidenz

@dside А зачем Вам винда? У меня Debian, и описанные Вами страдания мне незнакомы.

#Windows #MSWindows #SSH #OpenSSH #sshd #Debian #Linux #GNU #GNULinux

sshd(8) splitting continues https://www.undeadly.org/cgi?action=article;sid=20241014070554 #openbsd #openssh #ssh #sshd #sshd-auth #security #authentication

Защита от брутфорса и эксплоитов OpenSSH

В последних версиях OpenSSH появилась защита от брутфорса (перебора) паролей, а также от попыток эксплоита. Это очень ценные настройки, которыми разработчики рекомендуют воспользоваться всем. Нужно отметить, что новая функция OpenSSH фундаментально отличается от fail2ban , sshguard и подобных инструментов, поскольку она не парсит логи и не изменяет правила файрвола, а применяет опции только внутри одной программы, не обращаясь никуда через ядро, что делает её гораздо безопаснее вышеупомянутых утилит.

https://habr.com/ru/companies/globalsign/articles/835316/

#SSH #OpenSSH #sshd #PerSourcePenalties #PerSourcePenaltyExemptList #sshkeyscan #брутфорс #подбор_паролей #fail2ban #sshguard #Endlessh

Don't forget to update your server if you're running a SSH server! Article below gives what versions are affected by this vulnerability :blobfoxcomfycomputer:

https://www.qualys.com/regresshion-cve-2024-6387/

#security #linux #ssh #sshd #server