Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Putting SSH On Another Port is a Good Idea

danielmiessler.com

Post reply on HN
Print view View original

101–110 of 192 posts

Re: Why Putting SSH On Another Port is a Good Idea

#101

Post by dawkins »

kijin wrote: post #83
djcapelis wrote: post #3

2. Next he talks about this non-root listener issue. He claims that you shouldn’t run your SSH daemon on a non-privileged port because anyone can spin up a daemon up there. Great point, except you can still do that even if you run your main one on 22. I don't think I understand this point at all. What is it that you're trying to say? Are you sure you understood the original post's point? djc@capelis.dj:~$ nc -l -p 14…

Run it on a port where (port != 22 && port I run my SSH daemons on port 1022. It reduces brute-force attacks significantly without reducing security in any way that I'm aware of. I also have a ~/.ssh/config file in my laptop that tells SSH to use port 1022 whenever I'm connecting to one of my own remote machines so I don't even need to type anything extra when I use ssh, rsync, etc.

I run ssh in a non standar port and its annoying to always specify the port. Thank you for the tip about ~/.ssh/config

Re: Why Putting SSH On Another Port is a Good Idea

#102

Post by __david__ »

GalacticDomin8r wrote: post #76
__david__ wrote: post #36

Earlier quoted context omitted.

Turning off passwords and only using keys also mitigates the standard brute force attacks that happen. Frankly I'd much rather do that then have my server on a non-standard port.

> Frankly I'd much rather do that then have my server on a non-standard port. Frankly, the problems with key security and management are much worse than are being discussed. Using only keys is fine as long as your keys are secure and you know which is which and control all access and immediately remove any key which needs to be. In a complex environment, this is extremely difficult and more prone to security breaches…

I don't know. In complex environments that try to use passwords, I've observed that the password spreads until everyone knows it and then nobody can change it because "everyone already knows it and it would be a pain". Keys allow fine grained access and can theoretically be way more secure.

On the other hand, the last place I consulted for had their private key for production checked in to the main git repo, unencrypted. :-/

Re: Why Putting SSH On Another Port is a Good Idea

#103

Post by gnur »

GalacticDomin8r wrote: post #68
djcapelis wrote: post #8

Earlier quoted context omitted.

To be fair, you could get the advantages of both by running SSH on a different privileged port than 22. Many of the lower numbered even-numbered ones are good options as for historical reasons those are all mostly unassigned. (Pretty much any even number below 16 isn't used by much.) But I agree, the privileged ports point isn't something that should be brushed aside.

> To be fair, you could get the advantages of both by running SSH on a different privileged port than 22. ephemeral port range are a tunable at least on FreeBSD. However tuning stuff like this is fraught with disaster consider how difficult it is to guess an ssh password vs all things that can go wrong when changing sshd's listening port. But do it if you want, I bill by the hour. galacticdominator% sysctl net.inet.i…

What can go wrong by changing the listening port of sshd? I have changed the port on my vps purely for less clutter in my logs, but I haven't had anything go wrong because of it.

Re: Why Putting SSH On Another Port is a Good Idea

#105

Post by jvdh »

city41 wrote: post #6
djcapelis wrote: post #3

2. Next he talks about this non-root listener issue. He claims that you shouldn’t run your SSH daemon on a non-privileged port because anyone can spin up a daemon up there. Great point, except you can still do that even if you run your main one on 22. I don't think I understand this point at all. What is it that you're trying to say? Are you sure you understood the original post's point? djc@capelis.dj:~$ nc -l -p 14…

Privileged ports are why I disagree with this rebuttal. I want some assurance that when I ssh into a box, that I'm hitting a true and sanctioned sshd.

How are you going to log in to your shell, with your environment, without a daemon that has the suid bit? A user can never install such an sshd without having root permissions at some point.

If you run ssh on a static port, then it really does not matter whether it is 22 or 2200, as long as it remains static, and everyone knows the correct port.

If it turns out that that daemon is logging your passwords, then someone has already compromised your host.

Re: Why Putting SSH On Another Port is a Good Idea

#106

Post by lazugod »

sliverstorm wrote: post #73
cldr wrote: post #2

Ouch, camouflage on a tank is a good analogy. Nice response post. In addition to, as the author encourages, being "weary of the 'by obscurity'" argument (as I'm sure we all already are), I would also advocate being wary of it :)

Seriously, I think "wary" might be the most-misspelled word in the English language right now....

They're are much more common culprits out their.

Re: Why Putting SSH On Another Port is a Good Idea

#107

Post by jvdh »

abalone wrote: post #80

He's overreacting a bit. Port knocking is not just an "obscurity layer". It's more akin to a PIN or weak password. The condescending opening is a tip off ("people who almost understand the topic").

Even so, it is still a very weak security layer that you are adding on to something that is already very secure. Does that really make it less secure?

Now running SSH on a different port is an even weaker obscurity layer, but still, it still adds some security.

Re: Why Putting SSH On Another Port is a Good Idea

#109

Post by Sami_Lehtinen »

One question, why people always say that disabling passwords is important. AFAIK, passwords with keys is better than keys only. Now if someone gets the keys they can access the service with those keys without the passwords. Disabling passwords just makes security in one way worse. Think about chip & pin, because you have your credit card, wouldn't it be smart to disable PIN completely? Of course key ring could be encrypted, but that still allows off-line attack against it. If password is queried on-line, you can limit password attempts which you can't do in off-line situation. - Thanks

Re: Why Putting SSH On Another Port is a Good Idea

#110

Post by antocv »

kenrose wrote: post #31

Actually, one thing I've found useful is keeping an sshd listening on port 443. I know, I know, sacrilege reusing the HTTPS port, right? The benefit of this is that it can allow you to tunnel through an HTTP proxy (e.g., like in a corporate environment). Many HTTP proxies only allow traffic through to port 80 and port 443. The benefit of ssh on port 443 is that if the proxy is handed a CONNECT verb, it will transpare…

> Many HTTP proxies only allow traffic through to port 80 and port 443. The benefit of ssh on port 443 is that if the proxy is handed a CONNECT verb,

Thats not how HTTPS works, there is no HTTP proxy for 443. You are in a corporate environment where nothing is let out on port 80, except through their HTTP proxy. However, port 443 is allowed out.

> In fact, this behaviour is what makes HTTPS remain secure when going through an HTTP proxy.

That would be a MITM against https and it doenst work that way.

If you would go over the http proxy to connect to your sshd on port 443, that would be stupid as the proxy would see your connections. Its much easier and better to just connect directly without asking the proxy.

Post reply on HN