> On Feb 13, 2018, at 9:14 PM, Michelle Sullivan <miche...@sorbs.net> wrote:
> [snip]
> Personally - my thoughts ....
> There should be an option to enable passwords (default off...)
> A warning should be placed on the checkbox to inform the user it is not a 
> good idea to enable them.
> SSH should be disabled on external interfaces unless specifically enabled. 
> (what constitutes 'external' if there is no 'wan' port? ...i.e. AP only?)
> SSH without password in place and no keys should be unconditionally disabled 
> (and not enable-able - except by hand editing.)
> One could try to do what some manufacturers have done and open ssh for a 
> period of time if the WPS button is depressed for a certain length of time  
> as a 'fool proof' command login.... personally though I think anyone using 
> SSH instead of the webinterface is more than likely going to know what they 
> are doing and therefore it should not be an issue... ie err on the side of 
> 'there is an idiot at the controls, lets make it default as secure as 
> possible'...
> -- 
> Michelle Sullivan
> http://www.mhix.org/

Thanks for the suggestion.  Alas OpenSSH allows one to specify a ListenAddress 
which you could match to the “lan” or “wan” address(es).  Problem is that if 
you’re using DHCP on the “wan”, you’d have to rewrite the file (and restart the 
service) every time DHCP changed the address on the interface.

What would be better is if OpenSSH had a ListenInterface configuration 
parameter instead, and used netlink to listen for address changes… but that 
would be a bit of complexity (although you’d think it would be a common enough 
requirement for applications that someone would have come up with a library to 
do exactly that in a portable fashion).

Your conclusion is spot on: it’s hard to offer good security and make it 
foolproof at the same time because the approaches go in exactly opposite 
directions.  Security requires extreme pessimism, even paranoia, and 
user-friendliness implies being extremely forgiving.

It’s hard to have both.


Lede-dev mailing list

Reply via email to