Why putting SSH on another port than 22 is bad idea
adayinthelifeof.nl
Why putting SSH on another port than 22 is bad idea
1–10 of 64 posts
Re: Why putting SSH on another port than 22 is bad idea
#2I can write a simple script that listens to port 2222 and mimics SSH in order to capture your passwords.
ignoring other authentication methods, PKI, etc..
Re: Why putting SSH on another port than 22 is bad idea
#3obscurity is not security. nothing's going to stop people from portscanning your server no matter what port it is on.
Re: Why putting SSH on another port than 22 is bad idea
#4obscurity is not security. nothing's going to stop people from portscanning your server no matter what port it is on.
What percentage of attackers port scan a broad range of ports vs. just trying port 22?
Re: Why putting SSH on another port than 22 is bad idea
#5obscurity is not security. nothing's going to stop people from portscanning your server no matter what port it is on.
Moving ssh to a different port and using something like port-sentry could make it much harder. It will not increase your security per se, but it can make you less vulnerable to zero day exploits against random general internet scans.
Re: Why putting SSH on another port than 22 is bad idea
#6> capture your passwords
With public key auth, an attacker can't capture anything useful (unless of course they record traffic and later figure out a way to later capture the private key [1], but this isn't a problem that changing the port will fix).
> mimics SSH
You can't mimic the key files in /etc/ssh/ssh_host_whatever_key without root privileges, assuming these files are properly secured. So users will get an unexpected warning that the host key has changed.
> simple script that listens to port 2222
True -- in cases where something isn't already listening on 2222. But if sshd is started early in the boot process and listens on 2222, won't any script started as a regular user be unable to bind to the socket?
Re: Why putting SSH on another port than 22 is bad idea
#7obscurity is not security. nothing's going to stop people from portscanning your server no matter what port it is on.
Yeah, its not about increasing security against an individual but pretending to be a less appealing target to the masses.
Re: Why putting SSH on another port than 22 is bad idea
#8obscurity is not security. nothing's going to stop people from portscanning your server no matter what port it is on.
Moving to a different port keeps the server logs a lot cleaner, making real attacks easier to spot.
Re: Why putting SSH on another port than 22 is bad idea
#9I put SSH on a different port because it cuts down on the drive by login attempts. I don't have random users on my systems so I don't care that it's possible for non-priveleged users to listen on high ports, there shouldn't be anything listening on any port on my systems without my knowing about it. And I don't use running ssh on a different port as an excuse for lax security.
Under different circumstances different tradeoffs would apply, but for my current modes of use I don't see a compelling reason to put SSH on port 22.
Re: Why putting SSH on another port than 22 is bad idea
#10> capture your passwords With public key auth, an attacker can't capture anything useful (unless of course they record traffic and later figure out a way to later capture the private key [1], but this isn't a problem that changing the port will fix). > mimics SSH You can't mimic the key files in /etc/ssh/ssh_host_whatever_key without root privileges, assuming these files are properly secured. So users will get an une…
Also, what if ssh is on port 1023, which is still a non standard port, not default but privileged, does this help in any way?
I'm asking because I don't really know but have to set up my own servers from time to time (hobby admin).
Edit: I always use key based auth, don't allow root etc.