Hacker News new | ask | show | jobs
by jlgaddis 3296 days ago
Meh, I've got two hosts running SSH that are accessible from anywhere. They run OpenSSH on OpenBSD and are pretty locked down (only specific ciphers, key exchange algorithms, and MACs are permitted), root login is disabled, and password authentication is disabled, among other non-default configuration options. These two hosts allow access (via SSH) to another 40 or so boxes running various flavors and versions of Linux that can't be locked down as much.

I do not worry one bit about those two hosts getting compromised as I took the time to minimize the chances of that happening.
1 comments
thinkMOAR 3296 days ago
The fact you think that secures you, worries me, and that you share the almost exact setup you have with the world, just as much. Security is layers, and one layer is not telling the world about your setup.
link
jlgaddis 3296 days ago
Security is also not relying on obscurity to keep you safe.
link
thinkMOAR 3293 days ago
having your server ssh exposed to the world and trusting your configuration is relying on obscurity. Having strict firewalls, with only a limited amount of trusted ip addresses is anything but relying on obscurity.
link