Clever Geek Handbook

Ssh / VPN access from dynamic IPs / while traveling. knockd or dynDNS based authentication?

What are the advantages and disadvantages of using knockd versus using dynamic DNS authentication to log into ssh or VPN from a dynamic IP or while traveling (like some random hotel IP)? Ideally, any device with ssh / VPN client capabilities should be able to use any additional client software.

(An alternative that supports opening ssh / VPN ports for everyone is not very attractive.)

I tend to advocate for knockout (or other demons to detonate a port) because he doesn't rely on the outside, keeping his stuff uncompromising ...

-1


source to share


4 answers


Are you really afraid that your SSH port is open? What will happen?

You have denied root access, you have installed something like BFD or denyhosts, you are only using public key authentication ... do you really think this is not secure?



Adding something like knockd is, IMHO, it will probably lead to a false sense of security.

+3


source


Well, if you are not using DNSSEC, DNS based authentication is a pretty bad idea. DNS is not secure and service providers often use DNS.



+1


source


I myself use ssh on a non-standard port, only accepting usernames with keyfiles.

When I ran ssh on port 22, there were many dictionary attacks, but they all used the root user (who was not allowed to log into ssh anyway).

+1


source


Even if you leave the SSH port closed, you can leave the openvpn port open (and let openssh only listen on the vpn interface).

+1


source






More articles:


All Articles