We’re launching Lyria 3.5 in Google Flow Music, with advances across musicality, lyrics, vocals, and creative control
deepmind.google·6d ago
AI Engineering
Lobsters·Jun 18·5 min read
SSH port knocking with OpenBSD 7.9
TL;DR
Many users seek SSH port knocking for perceived security benefits, despite its drawbacks. The author configured OpenBSD 7.9's source limiter feature to reduce SSH brute force attempts while minimizing log entries.
✦ Why It Matters
Engineers can implement source limiting in OpenBSD to enhance security while reducing log clutter and hardware wear.
Key Takeaways
- Consider using source limiting to manage SSH access.
- Avoid logging unnecessary failed attempts to preserve hardware.
- Implement return-rst for stealthier blocking of unwanted access.
- Evaluate the trade-offs of security measures like port knocking.
Full Summary
Port knocking is a technique where a user must access specific ports in a predefined sequence to gain access, often seen as a false security measure. In this case, the author utilized OpenBSD 7.9's source limiter feature to manage incoming SSH connections more effectively.
By configuring the firewall to respond with a return-rst (reset) packet, the system avoids logging failed access attempts, which can wear out flash memory over time. The setup requires hitting the source limiter twice for each port, streamlining the access process.
The implementation led to a significant reduction in SSH brute force attempts, as evidenced by the absence of such entries in the logs. This approach not only enhances security but also prolongs the hardware's lifespan by minimizing unnecessary write operations.
Engineers can consider this method as a way to balance security and system performance.