Dedicated Server IPMI and providers exposing them to the public network

trewq

@jon617 said:
Note to providers. If you cannot do any of the above, run your IPMI's on alternate ports that would be difficult to guess. Don't run on ports 80/443. Lessens the security risk a little.

Security by obscurity isn't very effective.

jon617

@trewq said:
Security by obscurity isn't very effective.

Yup. I said "little", not "effective". :-)

If you're going to have a security hole, at least don't make it super obvious.

bsdguy

@trewq said:

@jon617 said:
Note to providers. If you cannot do any of the above, run your IPMI's on alternate ports that would be difficult to guess. Don't run on ports 80/443. Lessens the security risk a little.

Security by obscurity isn't very effective.

Wrong.

First because it actually does work quite well. Taking ssh, for instance from 22 to, say, 32547 will very much decrease the number of attacks (I guess most of them are by scriptkiddies running "c001 31i43 hackzors" scripts ...).

Second because crypto is obscurity generation. What are you doing when you encrypt "I love cookies!" with aes-256? You create obscurity. In fact you create high quality obscurity (e.g. properly random looking).

The "wisdom" repeated by you should be "creating security in obscure ways is insecure" because in ITsec we are very serious about mathematically sound, published, and thoroughly checked algorithms - but those algorithms then create ... obscurity.

trewq

@bsdguy said:

@trewq said:

@jon617 said:
Note to providers. If you cannot do any of the above, run your IPMI's on alternate ports that would be difficult to guess. Don't run on ports 80/443. Lessens the security risk a little.

Security by obscurity isn't very effective.

Wrong.

First because it actually does work quite well. Taking ssh, for instance from 22 to, say, 32547 will very much decrease the number of attacks (I guess most of them are by scriptkiddies running "c001 31i43 hackzors" scripts ...).

Second because crypto is obscurity generation. What are you doing when you encrypt "I love cookies!" with aes-256? You create obscurity. In fact you create high quality obscurity (e.g. properly random looking).

The "wisdom" repeated by you should be "creating security in obscure ways is insecure" because in ITsec we are very serious about mathematically sound, published, and thoroughly checked algorithms - but those algorithms then create ... obscurity.

You knew exactly what I meant. No need to be a dick.

bsdguy

trewq

Sorry, but you see I'm working in ITsec and you can probably hardly imagine how often I hear that dogma. Hell I have even young colleagues who repeat it.

I suggest you take my rant not as dickiness but rather as a useful excursion into ITsec