Why Putting SSH On Another Port is a Good Idea
danielmiessler.com
Why Putting SSH On Another Port is a Good Idea
1–10 of 192 posts
Re: Why Putting SSH On Another Port is a Good Idea
#2Ouch, camouflage on a tank is a good analogy. Nice response post.
In addition to, as the author encourages, being "weary of the 'by obscurity'" argument (as I'm sure we all already are), I would also advocate being wary of it :)
Re: Why Putting SSH On Another Port is a Good Idea
#3 2. Next he talks about this non-root listener issue. He
claims that you shouldn’t run your SSH daemon on a
non-privileged port because anyone can spin up a daemon
up there. Great point, except you can still do that even
if you run your main one on 22.
Are you sure you understood the original post's point?
djc@capelis.dj:~$ nc -l -p 14
nc: bind to source :: 14 failed: Permission denied
nc: bind to source 0.0.0.0 14 failed: Permission denied
nc: failed to bind to any local addr/port
djc@capelis.dj:~$ nc -l -p 1414
^C
(Edit: The original blog entry has now been edited to slightly clarify the wording. But the update mostly seems like an attempt to rapidly justify the author's original point.)
Re: Why Putting SSH On Another Port is a Good Idea
#4That was very fair response. Kudos for being able to attack the points, not the person.
Re: Why Putting SSH On Another Port is a Good Idea
#5I posted the original because I thought it was interesting. Elated to see an honest response. I love HN.
Re: Why Putting SSH On Another Port is a Good Idea
#62. Next he talks about this non-root listener issue. He claims that you shouldn’t run your SSH daemon on a non-privileged port because anyone can spin up a daemon up there. Great point, except you can still do that even if you run your main one on 22. I don't think I understand this point at all. What is it that you're trying to say? Are you sure you understood the original post's point? djc@capelis.dj:~$ nc -l -p 14…
Privileged ports are why I disagree with this rebuttal. I want some assurance that when I ssh into a box, that I'm hitting a true and sanctioned sshd.
Re: Why Putting SSH On Another Port is a Good Idea
#7I still can't understand why things like port knocking or single packet auth schemes like fwknop never really took off ...
Re: Why Putting SSH On Another Port is a Good Idea
#82. Next he talks about this non-root listener issue. He claims that you shouldn’t run your SSH daemon on a non-privileged port because anyone can spin up a daemon up there. Great point, except you can still do that even if you run your main one on 22. I don't think I understand this point at all. What is it that you're trying to say? Are you sure you understood the original post's point? djc@capelis.dj:~$ nc -l -p 14…
Privileged ports are why I disagree with this rebuttal. I want some assurance that when I ssh into a box, that I'm hitting a true and sanctioned sshd.
To be fair, you could get the advantages of both by running SSH on a different privileged port than 22. Many of the lower numbered even-numbered ones are good options as for historical reasons those are all mostly unassigned. (Pretty much any even number below 16 isn't used by much.)
But I agree, the privileged ports point isn't something that should be brushed aside.
Re: Why Putting SSH On Another Port is a Good Idea
#92. Next he talks about this non-root listener issue. He claims that you shouldn’t run your SSH daemon on a non-privileged port because anyone can spin up a daemon up there. Great point, except you can still do that even if you run your main one on 22. I don't think I understand this point at all. What is it that you're trying to say? Are you sure you understood the original post's point? djc@capelis.dj:~$ nc -l -p 14…
Privileged ports are why I disagree with this rebuttal. I want some assurance that when I ssh into a box, that I'm hitting a true and sanctioned sshd.
How can you ever tell that by port alone? If a box has been exploited, it's been exploited.
Re: Why Putting SSH On Another Port is a Good Idea
#102. Next he talks about this non-root listener issue. He claims that you shouldn’t run your SSH daemon on a non-privileged port because anyone can spin up a daemon up there. Great point, except you can still do that even if you run your main one on 22. I don't think I understand this point at all. What is it that you're trying to say? Are you sure you understood the original post's point? djc@capelis.dj:~$ nc -l -p 14…
Privileged ports are why I disagree with this rebuttal. I want some assurance that when I ssh into a box, that I'm hitting a true and sanctioned sshd.
The absolute best way to know that is to know the public host key and verify your keys. Additionally, you don't have to resort to high ports to achieve a best of breed. Just !=22 is enough to avoid majority of skiddies.