Punkie

Also does anyone still port knock these days?

If they did, would we know?

Basic setup for me is scripted on a new system. In regards to ssh, I make sure:

• Root account is disabled, sudo only
• ssh only by keys
• sshd blocks all users but a few, via AllowUsers
• All ‘default usernames’ are removed, like ec2-user or ubuntu for AWS ec2 systems
• The default ssh port moved if ssh has to be exposed to the Internet. No, this doesn’t make it “more secure” but damn, it reduces the script denials in my system logs, fight me.
• Services are only allowed connections by an allow list of IPs or subnets. Internal, when possible.

My systems are not “unhackable” but not low-hanging fruit, either. I assume everything I have out there can be hacked by someone SUPER determined, and have a vector of protection to mitigate backwash in case they gain full access.

I have been using Kubuntu as a daily driver for almost 10 year now, and never regretted it. I had one Windows box for things like special cases (like dumb website forms that won’t let me use Linux), Pearson Vue exams, and edge cases related to work, but it’s on standby as a secondary system I RDP into. I am not a gamer, so I didn’t need it for that. I saved so much money not having to buy hardware in the last decade or so.

Sadly, Windows 11 won’t work on anything I have (TPM issues, too old), so I recently got a cheap Windows 11 laptop before the tariffs hit and I pay more for dumb Windows-only reasons.

Linux all the way, man. Gave me a career, a life, and my hardware back.

“… I was now… a fem-MAN!” [Orchestra music swells]