Michael Rash writes about network security, mainly fwknop, Single Packet Authorization, port knocking, and fuzzing tools.
Commenters point to fwknop as an improvement over port knocking, noting that plain knocking is vulnerable to replay attacks.
I knew someone would raise an issue there.
If you're that concerned about security, there are a handful of additional things you can do:
* Use a non-standard ssh port
* Disable root ssh login
* Configure 'Single Packet Authorization and Port Knocking' -- http://www.cipherdyne.org/fwknop/
* Have decent iptables rules. Use either fail2ban or denyhosts with stringent rules, if you must, that ban on 3+ failed logins.
* Have a whitelist of acceptable IP's for ssh access
* Use any system of 2-factor authentication. I'm partial to Google's Authenticator. Here're some directions to get that set up, if anyone is interested: http://guides.webbynode.com/articles/security/ubuntu-google-authenticator.html
But seriously, if you have keys set up and someone manages to steal them... you've really got bigger things you should be focusing on.
> I don't use port-knocking but I really just don't get all those saying: "It's security theater".
It's not security theater but it's kind of outdated. Single Packet Authentication[0] is a significant improvement.
> How many exploits rendered cold dead in their tracks by port-knocking shall we need before people stop saying port-knocking is security theater?
Port knocking is one layer, but it shouldn't be the only one, or even a heavily relied upon one. Plenty of people might be in a position to see the sequence of ports you knock, for example.
Personally, I think if more people bothered to learn tools like SELinux instead of disabling it due to laziness or fear, that is what would stop most exploits dead. Containers are the middleground everyone attached to instead, though.
[0] https://www.cipherdyne.org/fwknop/docs/SPA.html
Exactly what fail2ban needed: a web UI for people to exploit.
If I could eliminate any Linux service, it would probably be fail2ban. As an SSH security measure, it's more than useless. If your SSH credentials can be brute forced, that's the problem, and it's easy to fix. Fail2ban just gives somebody a way to lock you out of your own system or to pin a core on your system by overloading it.
If you're trying to add security layers to SSH, here are some suggestions for doing so:
* fwknop (http://www.cipherdyne.org/fwknop/) -- Single Packet Auth based on GPG
* google_authenticator (https://code.google.com/p/google-authenticator/) -- PAM support for TOTP
* knockknock (https://github.com/moxie0/knockknock) -- Single Packet Auth using symmetric encryption
Normally, mod_security parses incoming traffic and blocks suspicious activity based on third-party rules [1]. Since you're using Squid, you can monitor outgoing traffic instead. Malicious traffic would get dropped instead of being proxied. Since you control the source servers, you could tarpit and/or ban the user.
Snort + Snortsam [2] or fwsnort [3] would do the same thing for non-HTTP traffic.
[1] https://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project
[2] http://www.snortsam.net
[3] http://cipherdyne.org/fwsnort/
Just like most similar tools, this lacks indices. For example, if you use ASGs (Auto Scaling Groups), all instances would have the same name tag, so, you need to be able to specify an index if there are multiple instances under the same name.
Edit 1: Created an issue [0] already.
Edit 2: Added a request [1] to integrate fwknop [2] for full automation and better security.
[0]: https://github.com/mikery/ssh2ec2/issues/1
[1]: https://github.com/mikery/ssh2ec2/issues/2
[2]: http://www.cipherdyne.org/fwknop/
<shameless_plug>
Check out fwknop, https://www.cipherdyne.org/fwknop/
It's one solution to this problem. Instead of answering with garbage, it allows for keeping the firewall closed/default drop stance. It's port knocking, but with real cryptography instead of just relying on hitting port numbers, and does it with just a single packet.
</shameless_plug>
Full disclosure: I'm one of the Fwknop devs.