Author here. Just wanted to get some feedback on this. It's a simple proof of concept, not meant for production code. I found several similar techniques, but none exactly the same.
Short version:
Client and server share a key.
Each can generate a TOTP based hash.
Client sends hash to server listening on UDP.
If hashes match the server opens the normally closed ssh port for a few seconds (long enough to make a connection).
Like a Google Authenticator TOTP code, the correct hash changes every T seconds so identification of the UDP port and interception of the key is only helpful for a limited (if any) amount of time.
Is this worth turning into a robust daemon? Is there a better way to deal with constant ssh probing? A module in a firewall would be ideal. Environment based config would make it fairly easy to use in provisioning for ssh admin with a smaller scan footprint.
Thank you. I will definitely try the key only. That should reduce probing. Presence will still be there, but if it completely deters probing that will be good enough. I looked at fail2ban, but it seemed like a losing battle with botnet scans.
> it seemed like a losing battle with bonnet scans
I'm not sure I understand? fail2ban works like this:
it monitors configured log files for patterns/strings: in this case its looking for multiple failed logins within N minutes from the same IP.
If that condition is met, it adds an iptables rule to reject all connections from that IP.
If you're getting lots of random IPs, try tweaking the failures required or the timing window - you could reduce the number of failures and widen the window to better handle the situation where you might not get many hits from a given host.
If you're using key only access, you have much less to worry about: bots like that are just trying to defeat regular password auth. While its annoying unless its causing you network issues its not a concern once password auth is disabled.
That is the problem, it always seems to be random IPs. Thats why failtoban is a losing battle. Failtoban works per IP, but no matter how sensitive the ban rule there always seems to be an endless supply of new IPs.
I do use keys for ssh access so disabling passwords does cover most of the safety concern. I guess it is more of an annoyance than anything. It looks huge in the logs, but network usage wise it probably boils down to once every few minutes.
Birmingham, AL (US) must be really lucky with their festival scene. They have several significant festivals every year:
Sidewalk Film Festival
Sloss Fest
Brew Fest
Slice Fest
Secret Stages
I'm not sure if it is the local support or that they're just smaller. I expect we may have had a lot of excellent event organizers with solid experience looking for new jobs after City Stages wound down. City Stages was a 20+ year music festival that was generally successful logistically, but wasn't profitable.
When you think of it, though. If there are 5+ 10-20k attendance festivals every year in every metro area over 500k there are bound to be some regular screwups.
If the company is private then employees exercising options generally (always?) have clauses that restrict them from selling that stock whether they are accredited investors or not. Not a lawyer, but I think there may be two reasons: 1) prevent covert takeover from the original founders 2) prevent a general market for private companies (before IPO). IPO involves a lot of regulatory overhead to confirm full disclosure. I think the restriction is to maintain control, but it may be a legal requirement before public market.
In other words you can't sell except as part of a board approved sale of the company or a public offering. I think opportunities to buy are based on new issuance of stock (for accredited investors) not based on trades of existing stock.
I too assumed this limitation was widespread. But if unicorns are high-valued private companies, and there is a secondary market for their stock, then surely some holders are not restricted this way.
Anyone know why / what triggers that? When is it typical for stock granted to employees to actually be resellable?
Depends on the terms under which the employee is issued stock. From a 2014 article[1]:
Two months ago, an early Uber employee thought that he had found a buyer for
his vested stock, at $200 per share. But when his agent tried to seal the deal,
Uber refused to sign off on the transfer. Instead, it offered to buy back the
shares for around $135 a piece, which is within the same price range that Google
Ventures and TPG Capital had paid to invest in Uber the previous July. Take it or
hold it.
The employee also learned that Uber had amended its bylaws more than a year
earlier, in order to restrict unapproved secondary sales. It was unclear if the
bylaw change actually applied to shareholders who had not been party to the vote —
lawyers seem to disagree on this point of Delaware law — but Uber threatened
litigation if he tried to proceed. So he held. The financial and reputational
hassles of a lawsuit would have just been too much, even if he had won.
> Does this generally piss off the employer? I wonder if the employee faced any sort of retaliation or anything from this.
No, it should not piss off any employer!
The equity that is offered to you to as part of your employment is remuneration for your efforts. The employer should not be upset at you for wanting to convert that to cash. It is true that the employer might not want their stock to go to outside parties. In that case, they should arrange for alternate arrangements (buybacks, employee-liquidity in funding rounds etc). But you are not doing anything inherently unethical to warrant any retaliation.
That's more to the point I was getting at. There's the legal situation, and then the political one. Selling shares in a private company could raise some red flags from management thinking an employee wants to cash out and bail, management worried about the perception of the company's health (internally and externally), management concerns about loss of control, etc.
All reasons why managers might make life difficult for said employee after the fact.
They generally don't want their cap table to explode with randos, and if there's access to sensitive information, they obviously don't want the cases where unscrupulous party buys shares just to feed that data to competitors.
With that said, it's obviously in their interest to provide some liquidity to avoid their long-time employees from defecting to GOOG or NFLX or FB, which reward with perfectly liquid stock grants, so in case of demand from the buy-side an employer would orchestrate a secondary market transaction. On the buy side in most cases you'd see an SPV managed by the VC who invested in previous rounds (which helps with keeping the cap table low).
Ironically, for smaller VCs entire economics of their firms are based on these SPVs (which sometimes charge upwards of 2% management fee on top of 20% carry - and that's for a chunk shares sitting quietly doing nothing).
More typically, the company has the "right of first refusal" -- when a stockholder has an outside offer, they are first required to let the company buy their stock back at the price that the outsider is offering before selling to an outsider.
This is both to maintain control and to avoid having more than 500 shareholders, which triggers all kinds of additional regulations.
1) prevent covert takeover from the original founders
Wouldn't this be more reliable to do by keeping control via different classes of stock and or limiting the total size of the employee option pool to some significantly less percentage than the founders have? What's the most common/recommended size of the employee option pool (I want to say I've heard it is like 5-15% depending on the age of the company)?
> whether people retain their rights when they coordinate as a corporation.
You are incorrect. Citizens United was decided based on the notion of corporate personhood -- the notion that corporations themselves have rights as if they are a person. There are very succinct and upheld limitations on individual monetary contribution to campaigns.
However CU broke that by giving people the ability to launder political money through a corporation.
Also, most non-profits (those 501c3s that want tax exemption) can not do any sort of campaigning. Those that do are subject to taxes.
CU said specifically that corporations are people that can "say" (aka spend) whatever they want to get their message across. People can make individual donations to support this effort essentially getting around existing campaign restrictions.
Money does not equal speech and there was a good reason monetary donations were restricted. By removing the restrictions they have reduced the ability of the average person to be heard because they now have to buy a bigger megaphone than the billionaires.
You really do need to read up on corporate personhood and election law. Let me guess... FOX News fan?
It's also fairly consistent with past SCOTUS decisions, like the 1957 decision United States vs Auto Workers:
"The principle at stake is not peculiar to unions. It is applicable as well to associations of manufacturers, retail and wholesale trade groups, consumers' leagues, farmers' unions, religious groups, and every other association representing a segment of American life and taking an active part in our political campaigns and discussions .... It is therefore important -- vitally important -- that all channels of communication be open to [all of the above types of associations] during every election, that no point of view be restrained or barred, and that the people have access to the views of every group in the community."
Scalia's comment in CU itself is relevant here:
"The [First] Amendment is written in terms of “speech,” not speakers. Its text offers no foothold for excluding any category of speaker"
In this case, he's referring to the "category" of a corporation, which is referenced in the 1886 decision Pembina Consolidated Silver Mining Co. v. Pennsylvania:
"corporations are merely associations of individuals united for a special purpose"
which parallels the 1830 statement in Providence bank vs Billings by Chief Justice Marshall:
"The great object of an incorporation is to bestow the character and properties of individuality on a collective and changing body of men."
and even further back, to the 1790 case The Rev John Bracken v. The Visitors of Wm & Mary College, which was in essence about the question of whether those running the college were bound by the decisions of its original founders or whether they had the right to, collectively, make changes according to their assessment of how to best carry out the common purpose for which the college existed.
While not directly about speech, the 1819 case Dartmouth College v. Woodward establishes limits on the legislature's ability to modify private contracts, such as the charter that established Dartmouth, and a series of later decisions specified that any modification must not harm shareholders, founders, members, etc.
And Santa Clara County v Southern Pacific Railroad Company (1886) establishes (indirectly) that corporations are entitled to the same type of 14th amendment due-process and equal-protection rights as individuals. Basically, just because people have organized into a group doesn't mean the government can treat them worse than it would if they were not corporately organized.
With the adjustments in place to highlight same sex couples +relatively unique combinations of professions -- I'd love to see someone speak up with HEY! That's me and my spouse! I wish they had the numbers on those. Actually numbers on all of them would be interesting (raw, % population, % couples, etc).
Free coding camp. Social code review. A certification that includes doing real projects for non-profits. Even an interview prep at the end. I am looking at it as a quick way to brush up on current front end dev. They have HTML, CSS, JavaScript, React, D3, Node.js, etc, etc, etc.
Short version:
Client and server share a key.
Each can generate a TOTP based hash.
Client sends hash to server listening on UDP.
If hashes match the server opens the normally closed ssh port for a few seconds (long enough to make a connection).
Like a Google Authenticator TOTP code, the correct hash changes every T seconds so identification of the UDP port and interception of the key is only helpful for a limited (if any) amount of time.
Is this worth turning into a robust daemon? Is there a better way to deal with constant ssh probing? A module in a firewall would be ideal. Environment based config would make it fairly easy to use in provisioning for ssh admin with a smaller scan footprint.