Re: IP Firewalling by DNS name

From: Lowell Gilbert (freebsd-stable-local_at_be-well.no-ip.com)
Date: 05/31/05

  • Next message: David Wolfskill: "Re: IP Firewalling by DNS name" 
    To: Ivan Voras <ivoras@fer.hr>
To: freebsd-stable@FreeBSD.ORG
Date: 31 May 2005 11:54:25 -0400

    Oliver Fromme <olli@lurza.secnetix.de> writes:

    > Ivan Voras <ivoras@fer.hr> wrote:

    > > As I understand it, sshd actually accepts connections
    > > prior to checking hosts.allow?
    >
    > Yes, the connection is accepted first, because there is
    > no information available about it before it is accepted.
    > But if the check fails, the connection will be closed
    > immediately.

    Well, that's not necessarily the best way to explain it. When you're
    working with TCP wrappers, you're running out of inetd(8), so there
    isn't really any sshd at all until the wrappers have decided to allow
    the connection.

    > > In hosts.allow, there's an example for sshd but it contains:
    > >
    > > # Wrapping sshd(8) is not normally a good idea, but if you
    > > # need to do it, here's how
    > > #sshd : .evil.cracker.example.com : deny
    > >
    > > Why it's not a good idea? :)
    >
    > There are several reasons. First, it relies on DNS, which
    > is not necessarily a good idea. If someone can spoof your
    > DNS (which is not as difficult as many people think it is),
    > you're toast.
    >
    > Second, SSH provides authentication mechanisms which are
    > much more secure, such as public key authentication.
    > Also, SSH uses host keys for identification, so you don't
    > have to rely on DNS.

    The reason that it's generally considered a bad idea, though, is just
    that it's *slow*. If you're running inetd anyway, and don't get many
    ssh connections, you won't notice this issue, but if you get a lot of
    connections, you really want to run ssh as a daemon rather than
    starting it from scratch every time a new connection comes in.

    > However, in your case I think it's OK to use TCP wrapper,
    > because you want to use that in _addition_ to the usual SSH
    > authentication (for pre-filtering, so to speak), but not to
    > replace it. Just keep in mind that DNS results might not
    > be reliable.

    Absolutely. In fact, most people trying to wrap sshd are kidding
    themselves about getting any security benefit at all.
    _______________________________________________
    freebsd-stable@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-stable
    To unsubscribe, send any mail to "freebsd-stable-unsubscribe@freebsd.org"

  • Next message: David Wolfskill: "Re: IP Firewalling by DNS name"

    Relevant Pages

    • Re: What is The SSH?
      ... Building and Using SSH Tunnels ... What is an SSH tunnel? ... how to use it to make a connection to a server. ... You will need a working SSH client and server installation to build and test ...
      (microsoft.public.windows.server.networking)
    • Re: Problem connecting to SSH, OpenVMS7.3-2, HP TCP/IP v5.4 patched
      ... warning: Authentication failed. ... connection lost (Connection closed by remote host.). ... So, as you can see, I am trying to make an ssh connection with the ...
      (comp.os.vms)
    • Re: Keeping OpenSSH connections alive
      ... The TCP connection is timing out, not the SSH session. ... You can then, reconnect to the backgrounded screen session, upon relogin. ...
      (SSH)
    • Re: Remote Desktop Connection
      ... You can try a free two user version of SSL-Explorer to try it out. ... SSL-Explorer also supports a web based RDC and VNC access to desktop PCs on your network. ... OpenVPN is completely free like SSH. ... What if i have a linkys WiFi router, and does not have vpn feature, how could i secure the connection? ...
      (microsoft.public.windowsxp.work_remotely)
    • ssh connections hang; un-hang on subsequent connection
      ... I'm experiencing a strange problem with ssh connections to my ssh server ... I can make an initial connection to my ssh server fine. ... When I re-connect with ssh, the first session "thaws" and all ...
      (comp.security.ssh)