Thread View: bit.listserv.openbsd-pf
3 messages
3 total messages
Started by Johan Söderberg
Fri, 04 Mar 2011 14:04
Re: Suggestion for a new feature, port code
Author: Johan Söderberg
Date: Fri, 04 Mar 2011 14:04
Date: Fri, 04 Mar 2011 14:04
14 lines
1631 bytes
1631 bytes
In my mind this is not security by obscurity, no more than one-time passwords. The ports can be compared to the keys of a keyboard when typing a password. As with passwords, the implementation is not a secret. The port that is protected is not hidden, it is locked. It adds security and do not add attack vectors as it is implemented as a simple ruleset for pf, protecting sshd. It can also be combined with authpf. Why waste energy on spammed logs with scans and attacks, banning and luring with honeypots on the outside? Why give sshd unnecessary exposure as it may have weaknesses? http://en.wikipedia.org/wiki/Security_through_obscurity http://stackoverflow.com/questions/4486171/isnt-a-password-a-form-of-security- through-obscurity http://security.stackexchange.com/questions/1194/port-knocking-is-it-a-good-idea
Re: Suggestion for a new feature, port code
Author: Henning Brauer
Date: Fri, 04 Mar 2011 18:36
Date: Fri, 04 Mar 2011 18:36
23 lines
2028 bytes
2028 bytes
we will never let that shit even remotely close to our tree. period. * Johan S�derberg <johan.s.umea@gmail.com> [2011-03-04 15:00]: > In my mind this is not security by obscurity, no more than one-time passwords. > The ports can be compared to the keys of a keyboard when typing a password. > As with passwords, the implementation is not a secret. > The port that is protected is not hidden, it is locked. > It adds security and do not add attack vectors as it is implemented as a simple > ruleset for pf, protecting sshd. It can also be combined with authpf. > Why waste energy on spammed logs with scans and attacks, banning and luring with > honeypots on the outside? > Why give sshd unnecessary exposure as it may have weaknesses? > > http://en.wikipedia.org/wiki/Security_through_obscurity > http://stackoverflow.com/questions/4486171/isnt-a-password-a-form-of-security- > through-obscurity > http://security.stackexchange.com/questions/1194/port-knocking-is-it-a-good-idea -- Henning Brauer, hb@bsws.de, henning@openbsd.org BS Web Services, http://bsws.de Full-Service ISP - Secure Hosting, Mail and DNS Services Dedicated Servers, Rootservers, Application Hosting
Re: Suggestion for a new feature, port code
Author: Johan Söderberg
Date: Fri, 04 Mar 2011 22:38
Date: Fri, 04 Mar 2011 22:38
5 lines
1101 bytes
1101 bytes
Henning Brauer <henning <at> openbsd.org> writes: > we will never let that shit even remotely close to our tree. period. we don't need you to tell us that as that shit already works. full stop.
Thread Navigation
This is a paginated view of messages in the thread with full content displayed inline.
Messages are displayed in chronological order, with the original post highlighted in green.
Use pagination controls to navigate through all messages in large threads.
Back to All Threads