It’s not uncommon for people to try using it as their sole authentication so that wouldn’t be a surprise. But for it’s purpose, it’s perfect.

It is and it isn’t. It prevents random scans from opening 22 and attempting to authenticate, that’s basically the entire purpose. You still need good authentication after because you’re right, it’s not a security measure, it’s just a way to keep your logs useful and to keep botnets from beating the hell out of 22.

By “good authentication” I mean a key pair based authentication. That is impossible to brute force. If you use a password on 22 you shouldn’t open it at all and you should rethink allowing any remote access.

Put another way: You’re the doorman at a speak easy. You can answer the little window with “what’s the password?” to every jack ass that approaches, and you’d be asking all the time. But if they don’t know they have to knock “shave and a haircut” first, your job gets a lot easier and you’re dealing with a lot fewer nuisance password promptings.

You can also use it to blacklist. If someone tries to hit 22 without knocking you can blacklist that IP entirely because you know it’s nuisance.

If you do want to open 22, and there are plenty of good reasons to want to, just implement something called port knocking and you can do it safely.

Note with this you still need good authentication. That means no passwords, key based auth only.

Solr

triggered