Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why putting SSH on another port than 22 is bad idea

adayinthelifeof.nl

Post reply on HN
Print view View original

51–60 of 64 posts

Re: Why putting SSH on another port than 22 is bad idea

#51

Post by migrantgeek »

16s wrote: post #23

Security through obscurity is useless. I have heard people repeat this for the last 20 years. They are wrong and they have no idea what they are talking about. They just parrot what others say. Like chaos it perpetuates itself. We camouflage tanks. We build stealth fighters. If obscurity had zero value, we'd just paint the tanks bright pink with hot orange flames and drop all the stealth research too. No need to snea…

I agree. Changing the port or hiding with port knocking is useful especially for keeping logs clean.

Generally, I think it's best to avoid publicly accessible SSH but if needed, changing the port is a good idea.

I always remove password auth and direct root login however even though my machine is now secure, the logs are filled with failed login attempts.

Clean and tidy logs help spot anomalies indicative of real attacks and not someone looking for open port 22 and hoping the combo root/root somehow works.

I don't think it's wise to change the port and consider things safe. All other security advice still applies however changing the default port in addition to locking down access seems like a wise decision to me.

Re: Why putting SSH on another port than 22 is bad idea

#52

Post by nairteashop »

AnthonyMouse wrote: post #47
nairteashop wrote: post #13

> When we start SSH on port 22, we know for a fact that this is done by root. But what happens when we move SSH to port 2222? This port can be opened without a privileged account, which means I can write a simple script that listens to port 2222 and mimics SSH in order to capture your passwords. Well OP is assuming that I trust the root user of the machine I am SSH'ing to. If I do, then what's the concern? The root u…

>Well OP is assuming that I trust the root user of the machine I am SSH'ing to. If I do, then what's the concern? Trusting the root user is different from trusting everyone with shell access to that machine. Only root (or a process with the appropriate capability) can bind to port 22 because it's below port 1024. Normal users can bind to port 2222. So now $EVIL_USER puts "@reboot /home/$EVIL_USER/bind_port_2222" in h…

> So now $EVIL_USER puts "@reboot /home/$EVIL_USER/bind_port_2222" in his crontab, or some such other method of getting to port 2222 before the ssh daemon.

I hadn't thought of this. Setting up the malicious executable to somehow bind to the SSH port before the SSH daemon is able to and then rebooting the computer - assuming the user has reboot privileges - seems to be the only way to do this correct?

(Once the SSH daemon has bound to its assigned port, then I don't think the port matters - if the user is able to kill a root-owned SSH daemon, he's likely able to start his service on whatever port he wants).

Re: Why putting SSH on another port than 22 is bad idea

#53

Post by smutticus »

I run SSH on a non-standard port because it makes it easier to see when someone is genuinely targetting me for attack. If I run SSH on 22 then I won't know when someone is targetting me for attack since I'll be under constant script kiddie attacks from everywhere all at once. If I have nothing on 22 then all those attacks just get silently blackholed. Which is ideal.

Re: Why putting SSH on another port than 22 is bad idea

#54

Post by migrantgeek »

dionyziz wrote: post #29
rhubarbquid wrote: post #26

Earlier quoted context omitted.

Right, adding obscurity doesn't decrease security. It might help... worst case it does nothing.

It might actually decrease security, as it gives a false sense of security and people just take it as their only security measure in the end. Give them obscurity and they feel secure. There are countless examples of this, I don't believe I need to give some here.

What are some examples? Like hiding a wallet in a shoe at the beach? Even that is actually successful in some cases.

Most thieves aren't career criminals in search of wallets. Perhaps a respectable working man sees a wallet of a young rich kid currently in the water. The man could use some extra cash and sees large bills protruding from the wallet and decides to take it. Why not? The man has a family and that kid probably has a trust fund.

The wallet stuffed in a shoe or buried under a towel prevents temptation. It's not actually more secure but it keeps honest people honest.

Nothing is really secure. Adding security is all about making something harder. Harder to live with, harder to access, harder to do un-detected, etc. If hiding something from plain sight makes it even slightly more troublesome of a heist, it's actually security IMO.

It shouldn't be your only form of security but to write it off completely seems silly.

Re: Why putting SSH on another port than 22 is bad idea

#55

Post by IgorPartola »

The non root user issue is invalid. While I can start an ssh-like service on port 2222 as a non root user, I cannot read the private ssh server key owned by root. If the sshd got switched to one run by an unprivileged attacker, you would get a bad server fingerprint and not connect (you wouldn't, right?).

Re: Why putting SSH on another port than 22 is bad idea

#56

Post by AnthonyMouse »

nairteashop wrote: post #52
AnthonyMouse wrote: post #47

Earlier quoted context omitted.

>Well OP is assuming that I trust the root user of the machine I am SSH'ing to. If I do, then what's the concern? Trusting the root user is different from trusting everyone with shell access to that machine. Only root (or a process with the appropriate capability) can bind to port 22 because it's below port 1024. Normal users can bind to port 2222. So now $EVIL_USER puts "@reboot /home/$EVIL_USER/bind_port_2222" in h…

> So now $EVIL_USER puts "@reboot /home/$EVIL_USER/bind_port_2222" in his crontab, or some such other method of getting to port 2222 before the ssh daemon. I hadn't thought of this. Setting up the malicious executable to somehow bind to the SSH port before the SSH daemon is able to and then rebooting the computer - assuming the user has reboot privileges - seems to be the only way to do this correct? (Once the SSH da…

> Setting up the malicious executable to somehow bind to the SSH port before the SSH daemon is able to and then rebooting the computer - assuming the user has reboot privileges - seems to be the only way to do this correct?

Not necessarily. You wouldn't necessarily need reboot privileges, you could just wait until root reboots the machine for whatever unrelated reason (e.g. kernel update). And you could do the same thing with the daemon: Wait until some updated version of the daemon is released and when root is installing it there will be a race starting when the old version exits before the new version starts and binds the port.

You're also just causing trouble for yourself because then you have to worry about a bunch of arcana like whether the daemon is using SO_REUSEADDR, IPV6_V6ONLY, only binding to the IPv4 address when the machine is dual stack, etc.

Re: Why putting SSH on another port than 22 is bad idea

#57

Post by Aqueous »

thirsteh wrote: post #16
Aqueous wrote: post #3

obscurity is not security. nothing's going to stop people from portscanning your server no matter what port it is on.

Stop trying to make it so cut-and-dry. This is not pure cryptography where the adage actually applies (a cryptographic construction should remain secure if everything about it except the key is known.) You shouldn't mistake obscurity for security, but obscurity that doesn't actively bother the user doesn't hurt security. Again, emphasis on not mistaking obscurity for security, i.e. moving SSH to a port other than 22…

I don't see what moving it to 2222 does that turning off password authentication, requiring public key authentication disallowing remote root login, and fail2banning repeated login attempts doesn't.. Is there a vulnerability in SSH or our asymmetric key cryptography that I don't know about(other than the one possibly introduced to the random number generator)? If there is, is the NSA less likely to use 2222 to knock on our door than 22? The only thing - the only thing - that moving it to 2222 does is reduce load avg due to brute force botnet attacks. And banning ips after 3 failed connection attempts should have a similar effect on the load avg. That is the only benefit. If you ask me that benefit isn't enough for me to give up the time spent typing -p 2222 every time i run the ssh command.

Re: Why putting SSH on another port than 22 is bad idea

#58

Post by thirsteh »

Aqueous wrote: post #57
thirsteh wrote: post #16

Earlier quoted context omitted.

Stop trying to make it so cut-and-dry. This is not pure cryptography where the adage actually applies (a cryptographic construction should remain secure if everything about it except the key is known.) You shouldn't mistake obscurity for security, but obscurity that doesn't actively bother the user doesn't hurt security. Again, emphasis on not mistaking obscurity for security, i.e. moving SSH to a port other than 22…

I don't see what moving it to 2222 does that turning off password authentication, requiring public key authentication disallowing remote root login, and fail2banning repeated login attempts doesn't.. Is there a vulnerability in SSH or our asymmetric key cryptography that I don't know about(other than the one possibly introduced to the random number generator)? If there is, is the NSA less likely to use 2222 to knock…

Even if that's the only thing, that's not useless. Just don't mistake it for a security measure.

Also, you can put port numbers in your SSH config, so you never have to type them.

Re: Why putting SSH on another port than 22 is bad idea

#59

Post by petsos »

migrantgeek wrote: post #54
dionyziz wrote: post #29

Earlier quoted context omitted.

It might actually decrease security, as it gives a false sense of security and people just take it as their only security measure in the end. Give them obscurity and they feel secure. There are countless examples of this, I don't believe I need to give some here.

What are some examples? Like hiding a wallet in a shoe at the beach? Even that is actually successful in some cases. Most thieves aren't career criminals in search of wallets. Perhaps a respectable working man sees a wallet of a young rich kid currently in the water. The man could use some extra cash and sees large bills protruding from the wallet and decides to take it. Why not? The man has a family and that kid pro…

Now imagine a million people from all over the world passing by. Would hiding the wallet in the shoe help?

Re: Why putting SSH on another port than 22 is bad idea

#60

Post by lvh »

16s wrote: post #23

Security through obscurity is useless. I have heard people repeat this for the last 20 years. They are wrong and they have no idea what they are talking about. They just parrot what others say. Like chaos it perpetuates itself. We camouflage tanks. We build stealth fighters. If obscurity had zero value, we'd just paint the tanks bright pink with hot orange flames and drop all the stealth research too. No need to snea…

I think you're misunderstanding where that came from, or what it means.

The idea behind security through obscurity being bad isn't about stealthiness, it's about that the idea that an attacker not privy to details of the system isn't really disadvantaged. Using a secret custom cipher is worse than using publicly vetted and analyzed ciphers like AES or ChaCha20.

Specifically, port-knocking isn't about security through obscurity. Your secret is the knocking sequence. Making the port inaccessible without that makes sense.

Post reply on HN