Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why putting SSH on another port than 22 is bad idea

adayinthelifeof.nl

Post reply on HN
Print view View original

31–40 of 64 posts

Re: Why putting SSH on another port than 22 is bad idea

#31

Post by ceejayoz »

16s wrote: post #23

Security through obscurity is useless. I have heard people repeat this for the last 20 years. They are wrong and they have no idea what they are talking about. They just parrot what others say. Like chaos it perpetuates itself. We camouflage tanks. We build stealth fighters. If obscurity had zero value, we'd just paint the tanks bright pink with hot orange flames and drop all the stealth research too. No need to snea…

Hell, passwords and keys are just obscure strings.

Security through obscurity is only a problem if it's the only security.

Re: Why putting SSH on another port than 22 is bad idea

#32

Post by glesica »

edvinbesic wrote: post #10
csense wrote: post #6

> capture your passwords With public key auth, an attacker can't capture anything useful (unless of course they record traffic and later figure out a way to later capture the private key [1], but this isn't a problem that changing the port will fix). > mimics SSH You can't mimic the key files in /etc/ssh/ssh_host_whatever_key without root privileges, assuming these files are properly secured. So users will get an une…

Also, what if ssh is on port 1023, which is still a non standard port, not default but privileged, does this help in any way? I'm asking because I don't really know but have to set up my own servers from time to time (hobby admin). Edit: I always use key based auth, don't allow root etc.

It cleans up your log files, that's why I do it. If you run ssh on port 22 your log files with be full of script kiddies with turnkey exploits spamming every IP address they can find. Change the port and suddenly that the logs get much, much quieter. So it's not really a security technique, it's a convenience technique.

Re: Why putting SSH on another port than 22 is bad idea

#33

Post by danielrm26 »

Obscurity is only a poor security layer if it's used as a substitute for security instead of a supplement.

http://www.danielmiessler.com/blog/putting-ssh-another-port-...

Camouflage on tanks doesn't remove the armor; it just lowers the chance that it'll be needed.

Re: Why putting SSH on another port than 22 is bad idea

#34

Post by danielrm26 »

16s wrote: post #23

Security through obscurity is useless. I have heard people repeat this for the last 20 years. They are wrong and they have no idea what they are talking about. They just parrot what others say. Like chaos it perpetuates itself. We camouflage tanks. We build stealth fighters. If obscurity had zero value, we'd just paint the tanks bright pink with hot orange flames and drop all the stealth research too. No need to snea…

http://www.danielmiessler.com/study/security_and_obscurity/

Re: Why putting SSH on another port than 22 is bad idea

#36

Post by BryanB55 »

16s wrote: post #23

Security through obscurity is useless. I have heard people repeat this for the last 20 years. They are wrong and they have no idea what they are talking about. They just parrot what others say. Like chaos it perpetuates itself. We camouflage tanks. We build stealth fighters. If obscurity had zero value, we'd just paint the tanks bright pink with hot orange flames and drop all the stealth research too. No need to snea…

Thank you. Everytime I hear someone say that I cringe. So sick of hearing it. It's useful, just not the only thing you should be doing.

Re: Why putting SSH on another port than 22 is bad idea

#37

Post by atoponce »

So many problems with this article, it's very hard to take seriously. Let's start with not giving us reasons to protect the innocent. Oooh. Scary! He must be a real pro at security! He's keeping secrets that are too valuable to share! Please.

Next, he talks about anyone setting up a script to listen on a non privileged port to collect passwords. Okay. So, are you saying I shouldn't connect to your server then? Because if I set MY server's SSH port on 2222, I'm not worried about anyone collecting passwords on MY server. Unless they have root. Then I have bigger problems, and they can also collect my password when logging on to port 22.

Also, security through obscurity is hardly useless. Sure, don't use it as your only security defense, but it does have value. Obscurity means hiding something of value from plain sight. Can you find that object? Sure. That doesn't mean stealth is pointless. If so, we wouldn't have camouflage, stealth bombers, and the NSA. Stealth can be be valuable.

Lastly is keys over passwords. Again, unless you have root on the box, you're not getting the login password without brute force, or some protocol vulnerability. And, if your password is weak, what makes you think using keys is any stronger? First, you can create SSH keys without encrypting it with a password. If you choose to encrypt it with a password, what makes you think that password will be any stronger? Sure, remote password brute forcing us infeasible, but scanning Github for private keys isn't. What's one server versus another, unless you're targeting the user?

No, this article isn't thought through.

Re: Why putting SSH on another port than 22 is bad idea

#38

Post by badman_ting »

Security through obscurity is not to be avoided outright, using only security through obscurity is to be avoided outright. If you have an otherwise secure system and then you obscure it in some ways, the worst that can happen is that it has no effect. So the problem is in thinking it alone will protect you, but it is not harmful in itself.

I think people throw this phrase out because it scans nicely and makes you sound like you know what you're talking about, especially to yourself.

Re: Why putting SSH on another port than 22 is bad idea

#39

Post by nairteashop »

theboss wrote: post #21
nairteashop wrote: post #13

> When we start SSH on port 22, we know for a fact that this is done by root. But what happens when we move SSH to port 2222? This port can be opened without a privileged account, which means I can write a simple script that listens to port 2222 and mimics SSH in order to capture your passwords. Well OP is assuming that I trust the root user of the machine I am SSH'ing to. If I do, then what's the concern? The root u…

If you don't trust the other side, you aren't administering the server, in which case this article isn't written for you. If you are, then the author is 100% correct that it is not a good idea to run a SSH server above port 1024, or any port other than 22. There are much better solutions to dealing with drive-by attempted logins, and some of them are built into ssh.

> If you are, then the author is 100% correct that it is not a good idea to run a SSH server above port 1024, or any port other than 22.

Ok, but you haven't explained why. The author's stated claim is that running an SSH server over 1024 means the connecting party cannot trust the server, but that of course doesn't apply if you are running the server.

If you want to truly secure your server, then yeah, changing the port doesn't really do much but there are some minor benefits (see other responses in this thread, and on the internet). I'm still not seeing the harm.

Re: Why putting SSH on another port than 22 is bad idea

#40

Post by laureny »

16s wrote: post #23

Security through obscurity is useless. I have heard people repeat this for the last 20 years. They are wrong and they have no idea what they are talking about. They just parrot what others say. Like chaos it perpetuates itself. We camouflage tanks. We build stealth fighters. If obscurity had zero value, we'd just paint the tanks bright pink with hot orange flames and drop all the stealth research too. No need to snea…

> We camouflage tanks. We build stealth fighters.

A lot of the army forces are wearing camo fatigues 100% of the time while in combat zones, I'm sure they would have a lot to learn from you.

Sarcasm aside, security through obscurity is not very useful when it's the only defense vector used but it's very important when it's part of a multi-angle defense. The more hurdles you put on the path of hackers, the more time you buy to defend against them.

Post reply on HN