a) Nobody doing this expects that it will increase the difficulty of cracking the server via SSH, or at least nobody I've talked to does it for this reason and I certainly don't.
b) Since when is the uid that started a process a form of authentication?
c) Who cares what the default settings are for most SSH clients? It's trivial to put it in your config file and forget about it.
d) Using port 443 for SSH is a legitimate use to get around firewalls/traffic shapers.
Why putting SSH on another port than 22 is bad idea
41–50 of 64 posts
Re: Why putting SSH on another port than 22 is bad idea
#42Earlier quoted context omitted.
If you don't trust the other side, you aren't administering the server, in which case this article isn't written for you. If you are, then the author is 100% correct that it is not a good idea to run a SSH server above port 1024, or any port other than 22. There are much better solutions to dealing with drive-by attempted logins, and some of them are built into ssh.
There are plenty of unassigned ports below 1024 that you could happily use without theoretically stepping on toes, why not use one of them? Further down the page there are several people stating tangible benefits for moving off port 22.
I said above 1024 and picking on other than 22 is just Security Through Obscurity. I can banner grab you in less than a second and figure out which port is running an ssh server. If you really want to then go for it. But above 1024 is a no go.
Re: Why putting SSH on another port than 22 is bad idea
#43Earlier quoted context omitted.
If you don't trust the other side, you aren't administering the server, in which case this article isn't written for you. If you are, then the author is 100% correct that it is not a good idea to run a SSH server above port 1024, or any port other than 22. There are much better solutions to dealing with drive-by attempted logins, and some of them are built into ssh.
> If you are, then the author is 100% correct that it is not a good idea to run a SSH server above port 1024, or any port other than 22. Ok, but you haven't explained why. The author's stated claim is that running an SSH server over 1024 means the connecting party cannot trust the server, but that of course doesn't apply if you are running the server. If you want to truly secure your server, then yeah, changing the p…
If you are running the server and your server is compromised than the attacker can remove the ssh server you are running and put up his own malicious program to collect your password if and only if they port is above 1024, and they don't need root privileges, they can have www-data privileges or whatever
Re: Why putting SSH on another port than 22 is bad idea
#44Earlier quoted context omitted.
If you don't trust the other side, you aren't administering the server, in which case this article isn't written for you. If you are, then the author is 100% correct that it is not a good idea to run a SSH server above port 1024, or any port other than 22. There are much better solutions to dealing with drive-by attempted logins, and some of them are built into ssh.
> If you are, then the author is 100% correct that it is not a good idea to run a SSH server above port 1024, or any port other than 22. Ok, but you haven't explained why. The author's stated claim is that running an SSH server over 1024 means the connecting party cannot trust the server, but that of course doesn't apply if you are running the server. If you want to truly secure your server, then yeah, changing the p…
Put another way, if someone has gained access to run a script as a non-root user on my server, and somehow managed to kill SSH which is running as root to bind to that port, gained access to my host key (which should only be readable by root), so that my ssh client won't warn me when I connect, and is now running an ssh-alike on that port, I'm pretty well owned already. It's hard to see how someone with this much access doesn't have enough to go ahead an run their ssh-alike on port 22.
That said, I run ssh on a non-standard port for one reason only, it's a crap-load easier to check the log files for suspicious activity that way. I still run use the same protections I do for servers with ssh on 22.
Re: Why putting SSH on another port than 22 is bad idea
#45[deleted]
Re: Why putting SSH on another port than 22 is bad idea
#46Earlier quoted context omitted.
> If you are, then the author is 100% correct that it is not a good idea to run a SSH server above port 1024, or any port other than 22. Ok, but you haven't explained why. The author's stated claim is that running an SSH server over 1024 means the connecting party cannot trust the server, but that of course doesn't apply if you are running the server. If you want to truly secure your server, then yeah, changing the p…
If you are running the server and your server is compromised than the attacker can remove the ssh server you are running and put up his own malicious program to collect your password if and only if they port is above 1024, and they don't need root privileges, they can have www-data privileges or whatever
Again if he can remove ssh running as root on port 1xxxx, he can run his ssh-alike on port 22.
Re: Why putting SSH on another port than 22 is bad idea
#47> When we start SSH on port 22, we know for a fact that this is done by root. But what happens when we move SSH to port 2222? This port can be opened without a privileged account, which means I can write a simple script that listens to port 2222 and mimics SSH in order to capture your passwords. Well OP is assuming that I trust the root user of the machine I am SSH'ing to. If I do, then what's the concern? The root u…
>Well OP is assuming that I trust the root user of the machine I am SSH'ing to. If I do, then what's the concern?
Trusting the root user is different from trusting everyone with shell access to that machine. Only root (or a process with the appropriate capability) can bind to port 22 because it's below port 1024. Normal users can bind to port 2222. So now $EVIL_USER puts "@reboot /home/$EVIL_USER/bind_port_2222" in his crontab, or some such other method of getting to port 2222 before the ssh daemon.
This is mostly mitigated by the fact that $EVIL_USER can't read the host private keys which means that the impersonation will be detected by anyone who has the host in the known_hosts file, but that only counts for ssh, and assumes you've connected to the host previously. If you're running something like DNS or FTP on a multi-user machine, using a non-privileged port is a Bad Idea.
Re: Why putting SSH on another port than 22 is bad idea
#48Earlier quoted context omitted.
If you are running the server and your server is compromised than the attacker can remove the ssh server you are running and put up his own malicious program to collect your password if and only if they port is above 1024, and they don't need root privileges, they can have www-data privileges or whatever
Again if he can remove ssh running as root on port 1xxxx, he can run his ssh-alike on port 22.
but he can do 1xxx from an unprivileged NOT ROOT and he requires root to do that with port 22, again
Re: Why putting SSH on another port than 22 is bad idea
#49[deleted]
Re: Why putting SSH on another port than 22 is bad idea
#50Earlier quoted context omitted.
Again if he can remove ssh running as root on port 1xxxx, he can run his ssh-alike on port 22.
but he can do 1xxx from an unprivileged NOT ROOT and he requires root to do that with port 22, again
So basically, he's gained root once to kill ssh running as root, but you think that gaining root again in order to run something on port 22 is what's going to stop him?