Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why putting SSH on another port than 22 is bad idea

adayinthelifeof.nl

Post reply on HN
Print view View original

21–30 of 64 posts

Re: Why putting SSH on another port than 22 is bad idea

#21

Post by theboss »

nairteashop wrote: post #13

> When we start SSH on port 22, we know for a fact that this is done by root. But what happens when we move SSH to port 2222? This port can be opened without a privileged account, which means I can write a simple script that listens to port 2222 and mimics SSH in order to capture your passwords. Well OP is assuming that I trust the root user of the machine I am SSH'ing to. If I do, then what's the concern? The root u…

If you don't trust the other side, you aren't administering the server, in which case this article isn't written for you.

If you are, then the author is 100% correct that it is not a good idea to run a SSH server above port 1024, or any port other than 22.

There are much better solutions to dealing with drive-by attempted logins, and some of them are built into ssh.

Re: Why putting SSH on another port than 22 is bad idea

#22

Post by ericd »

thirsteh wrote: post #16
Aqueous wrote: post #3

obscurity is not security. nothing's going to stop people from portscanning your server no matter what port it is on.

Stop trying to make it so cut-and-dry. This is not pure cryptography where the adage actually applies (a cryptographic construction should remain secure if everything about it except the key is known.) You shouldn't mistake obscurity for security, but obscurity that doesn't actively bother the user doesn't hurt security. Again, emphasis on not mistaking obscurity for security, i.e. moving SSH to a port other than 22…

Good rebuttal. Maybe we should start downvoting so that this truism that constantly gets trotted out can go away.

On the other hand, your explanation plus the other replies probably help people dispel this notion for others, so maybe it's good to keep this kind of thing coming around.

Re: Why putting SSH on another port than 22 is bad idea

#23

Post by 16s »

Security through obscurity is useless. I have heard people repeat this for the last 20 years. They are wrong and they have no idea what they are talking about. They just parrot what others say. Like chaos it perpetuates itself.

We camouflage tanks. We build stealth fighters. If obscurity had zero value, we'd just paint the tanks bright pink with hot orange flames and drop all the stealth research too. No need to sneak around. Obscurity is useless right?

Hide from the bear and it might not find and eat you. Move your ssh port and your logs will have less idiots out there filling them up. That fact alone is worth changing ports.

Obscurity has its place along side other tactics. And when you put it all together, you'll have a more secure system.

So please cut the "Security through obscurity" crap.

Re: Why putting SSH on another port than 22 is bad idea

#24

Post by Zoomla »

16s wrote: post #23

Security through obscurity is useless. I have heard people repeat this for the last 20 years. They are wrong and they have no idea what they are talking about. They just parrot what others say. Like chaos it perpetuates itself. We camouflage tanks. We build stealth fighters. If obscurity had zero value, we'd just paint the tanks bright pink with hot orange flames and drop all the stealth research too. No need to snea…

this is so true... like if you use port knocking, how can that not increase security

Re: Why putting SSH on another port than 22 is bad idea

#25

Post by vacri »

theboss wrote: post #21
nairteashop wrote: post #13

> When we start SSH on port 22, we know for a fact that this is done by root. But what happens when we move SSH to port 2222? This port can be opened without a privileged account, which means I can write a simple script that listens to port 2222 and mimics SSH in order to capture your passwords. Well OP is assuming that I trust the root user of the machine I am SSH'ing to. If I do, then what's the concern? The root u…

If you don't trust the other side, you aren't administering the server, in which case this article isn't written for you. If you are, then the author is 100% correct that it is not a good idea to run a SSH server above port 1024, or any port other than 22. There are much better solutions to dealing with drive-by attempted logins, and some of them are built into ssh.

There are plenty of unassigned ports below 1024 that you could happily use without theoretically stepping on toes, why not use one of them? Further down the page there are several people stating tangible benefits for moving off port 22.

Re: Why putting SSH on another port than 22 is bad idea

#26

Post by rhubarbquid »

16s wrote: post #23

Security through obscurity is useless. I have heard people repeat this for the last 20 years. They are wrong and they have no idea what they are talking about. They just parrot what others say. Like chaos it perpetuates itself. We camouflage tanks. We build stealth fighters. If obscurity had zero value, we'd just paint the tanks bright pink with hot orange flames and drop all the stealth research too. No need to snea…

Right, adding obscurity doesn't decrease security. It might help... worst case it does nothing.

Re: Why putting SSH on another port than 22 is bad idea

#27

Post by jaequery »

theboss wrote: post #21
nairteashop wrote: post #13

> When we start SSH on port 22, we know for a fact that this is done by root. But what happens when we move SSH to port 2222? This port can be opened without a privileged account, which means I can write a simple script that listens to port 2222 and mimics SSH in order to capture your passwords. Well OP is assuming that I trust the root user of the machine I am SSH'ing to. If I do, then what's the concern? The root u…

If you don't trust the other side, you aren't administering the server, in which case this article isn't written for you. If you are, then the author is 100% correct that it is not a good idea to run a SSH server above port 1024, or any port other than 22. There are much better solutions to dealing with drive-by attempted logins, and some of them are built into ssh.

What OP points out is good for starters but If you were really serious about security, you'd be locking your servers behind VPN and 2 factor auths. Cloudpassage.com does a pretty good job for locking down your servers for truly serious.

Re: Why putting SSH on another port than 22 is bad idea

#28

Post by rhubarbquid »

edvinbesic wrote: post #10
csense wrote: post #6

> capture your passwords With public key auth, an attacker can't capture anything useful (unless of course they record traffic and later figure out a way to later capture the private key [1], but this isn't a problem that changing the port will fix). > mimics SSH You can't mimic the key files in /etc/ssh/ssh_host_whatever_key without root privileges, assuming these files are properly secured. So users will get an une…

Also, what if ssh is on port 1023, which is still a non standard port, not default but privileged, does this help in any way? I'm asking because I don't really know but have to set up my own servers from time to time (hobby admin). Edit: I always use key based auth, don't allow root etc.

I can't say for sure it would help in any useful way, but it won't reduce your security to run ssh on port 1023.

Re: Why putting SSH on another port than 22 is bad idea

#29

Post by dionyziz »

rhubarbquid wrote: post #26
16s wrote: post #23

Security through obscurity is useless. I have heard people repeat this for the last 20 years. They are wrong and they have no idea what they are talking about. They just parrot what others say. Like chaos it perpetuates itself. We camouflage tanks. We build stealth fighters. If obscurity had zero value, we'd just paint the tanks bright pink with hot orange flames and drop all the stealth research too. No need to snea…

Right, adding obscurity doesn't decrease security. It might help... worst case it does nothing.

It might actually decrease security, as it gives a false sense of security and people just take it as their only security measure in the end. Give them obscurity and they feel secure. There are countless examples of this, I don't believe I need to give some here.

Re: Why putting SSH on another port than 22 is bad idea

#30

Post by onedognight »

> So running SSH on a non-privileged port makes it potentially LESS secure, not MORE. You have no way of knowing if you are talking to the real SSH server or not.

Of course you do: the SSH host keys. They are an integral part of the SSH trust model. If you blindly accept any host key thrown at you, for a machine you didn't just boot for the first time, then nothing can help you as you can easily be man-in-the-middled even if you are using port 22 (say from the cafe wireless you are using).

Post reply on HN