Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why putting SSH on another port than 22 is bad idea

adayinthelifeof.nl

Post reply on HN
Print view View original

11–20 of 64 posts

Re: Why putting SSH on another port than 22 is bad idea

#11

Post by rietta »

Aqueous wrote: post #3

obscurity is not security. nothing's going to stop people from portscanning your server no matter what port it is on.

I like to run hardened SSH servers - key only authentication and specific lists of permitted users. From a security point of view this works on the default port or an alternate port. Root is blocked from logging in directly.

Having SSH moved to an alternate port helps mitigate the load caused by continuous SSH worm connections. Having the firewall additionally block SSH except from pre-approved adds additional defense, but adds the complexity that the admin cannot login from his mobile phone using just SSH without first adding his current temporary IP address to the firewall.

The alternate port, is not by itself a security mechanism but it can help in real life deployments.

It is a good article and raises really good points. I have bookmarked it because I do want to experiment with the author's iptables example.

Re: Why putting SSH on another port than 22 is bad idea

#12

Post by dijit »

This raises a few questions.

firstly, How does he hope to mimic SSH with a script, when most 'companies' will roll out DNS sshfp records, heck, I even do it at home. -- he'd need to access the private keys in /etc/ssh/ to be able to do anything; unless he's rooted my box, I don't see how he could.

Secondly; he'd need to kill my sshd process in order to make his script work, sshd is not the kind of process driven behemoth that apache+modphp is, so you can't brute force it to death- how are you going to kill it if you're not root?

Finally; if you kill my sshd- where does your session go.

of course, all of this could be bypassed if you had root, but if you are root you can do anything anyway- you could capture and decrypt data with the private keys- surely that'd be easier.

(also, if you're root you can bind port 22 anyway, so it's a moot point)

Re: Why putting SSH on another port than 22 is bad idea

#13

Post by nairteashop »

> When we start SSH on port 22, we know for a fact that this is done by root. But what happens when we move SSH to port 2222? This port can be opened without a privileged account, which means I can write a simple script that listens to port 2222 and mimics SSH in order to capture your passwords.

Well OP is assuming that I trust the root user of the machine I am SSH'ing to. If I do, then what's the concern? The root user probably told me what the SSH port is. If I don't, then well what's to say the SSH daemon on port 22 is secure? In any case, there are many other ports that are not 22 and are Changing the port is not the ultimate defense against attack, but in my experience it does reduce random drive-by type attacks. Same reason you raise your windows when you lock your car - as easy as it is to break a car window, a thief would rather steal from a car with an open window than smash your windows and steal from yours.

Re: Why putting SSH on another port than 22 is bad idea

#15

Post by edvinbesic »

InclinedPlane wrote: post #9

I put SSH on a different port because it cuts down on the drive by login attempts. I don't have random users on my systems so I don't care that it's possible for non-priveleged users to listen on high ports, there shouldn't be anything listening on any port on my systems without my knowing about it. And I don't use running ssh on a different port as an excuse for lax security. Under different circumstances different…

This has been my general theorycraft as well. It's still on a privileged port but not standard. I'm curios as to if it has any effect though or if it's all pointless.

Re: Why putting SSH on another port than 22 is bad idea

#16

Post by thirsteh »

Aqueous wrote: post #3

obscurity is not security. nothing's going to stop people from portscanning your server no matter what port it is on.

Stop trying to make it so cut-and-dry. This is not pure cryptography where the adage actually applies (a cryptographic construction should remain secure if everything about it except the key is known.)

You shouldn't mistake obscurity for security, but obscurity that doesn't actively bother the user doesn't hurt security. Again, emphasis on not mistaking obscurity for security, i.e. moving SSH to a port other than 22 does not mean that you can keep using password authentication.

Virtually all DNS servers on the Internet deny zone transfers (AXFR). This is entirely an "obscurity" measure, but it's still useful as long as people don't assume one of their hosts won't be found if it has a guessable hostname or IP address. There are many other examples.

Re: Why putting SSH on another port than 22 is bad idea

#18

Post by rietta »

gabemart wrote: post #4
Aqueous wrote: post #3

obscurity is not security. nothing's going to stop people from portscanning your server no matter what port it is on.

What percentage of attackers port scan a broad range of ports vs. just trying port 22?

I have not measured it in a long time, but the effect of blocking port 22 and leaving open a non-standard SSH port is dramatic! As in noticeable decrease in load average on the server.
Post reply on HN