Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Putting SSH On Another Port is a Good Idea

danielmiessler.com

Post reply on HN
Print view View original

121–130 of 192 posts

Re: Why Putting SSH On Another Port is a Good Idea

#121

Post by cagriemer »

simias wrote: post #112
kijin wrote: post #83

Earlier quoted context omitted.

Run it on a port where (port != 22 && port I run my SSH daemons on port 1022. It reduces brute-force attacks significantly without reducing security in any way that I'm aware of. I also have a ~/.ssh/config file in my laptop that tells SSH to use port 1022 whenever I'm connecting to one of my own remote machines so I don't even need to type anything extra when I use ssh, rsync, etc.

I agree but I think TFA should clarify that it's probably a good idea to run sshd on a non-standard port . While other posters are right to point out that server certificate should make sure nobody can truly hijack your sshd there's no point in taking the risk unless for some reason all privileged ports are in use. Not to mention that ssh's key model is a bit broken since there's not built-in way to distribute the ke…

Have a look at SSHFP[1] DNS resource record. If you combine SSHFP record with DNSSEC, you can actually validate the fingerprint.

[1] http://tools.ietf.org/html/rfc4255

Re: Why Putting SSH On Another Port is a Good Idea

#122

Post by [deleted] »

simias wrote: post #112
kijin wrote: post #83

Earlier quoted context omitted.

Run it on a port where (port != 22 && port I run my SSH daemons on port 1022. It reduces brute-force attacks significantly without reducing security in any way that I'm aware of. I also have a ~/.ssh/config file in my laptop that tells SSH to use port 1022 whenever I'm connecting to one of my own remote machines so I don't even need to type anything extra when I use ssh, rsync, etc.

I agree but I think TFA should clarify that it's probably a good idea to run sshd on a non-standard port . While other posters are right to point out that server certificate should make sure nobody can truly hijack your sshd there's no point in taking the risk unless for some reason all privileged ports are in use. Not to mention that ssh's key model is a bit broken since there's not built-in way to distribute the ke…

[deleted]

Re: Why Putting SSH On Another Port is a Good Idea

#123

Post by n0on3 »

I apologize but there is no such thing as "it is (ALWAYS|NEVER) a good idea" no matter how many blog posts people wrote about that.

It just depends on which are the tradeoffs between the antithetic goals that you have when you do any kind of security hardening.

Aside from that, since many already mentioned port knocking as another layer in the pile of this game, let me point out that not all port knocking (-like) implementations are that weak, look e.g. at knockknock [ http://www.thoughtcrime.org/software/knockknock/ ].

Re: Why Putting SSH On Another Port is a Good Idea

#125

Post by markeganfuller »

relix wrote: post #113
cldr wrote: post #2

Ouch, camouflage on a tank is a good analogy. Nice response post. In addition to, as the author encourages, being "weary of the 'by obscurity'" argument (as I'm sure we all already are), I would also advocate being wary of it :)

No it isn't. Every server runs SSH, so this is more like there's a field, and you know there's a tank in the field, but you can't see it. The next thing you do then is take out your standard radar device which scans the field, and pinpoints exactly where the tank is in 3 seconds, and then you aim your tank buster at that spot and fire.

Except unless your only target is that one tank you're not going to scan all its ports.

Re: Why Putting SSH On Another Port is a Good Idea

#126

Post by swinglock »

quesera wrote: post #57

In moving sshd to an alternate port, I've noticed two things: a greatly decreased amount of log noise from dictionary attacks, and a moderately increased amount of portscans. It's reasonably clear to your average net malfeasant that any host running recognizable services is going to be running sshd. So why not do both? Put a dummy sshd on 22/tcp, deny all auth attempts, log whatever keeps you swimming in interesting…

Try kippo, it's a whole bunch of fun. Redirect the port in iptables to a kippo VM to stay safe as well, but I don't think anyone's broken out of it.

Re: Why Putting SSH On Another Port is a Good Idea

#127

Post by microtonal »

lotyrin wrote: post #58
wildgift wrote: post #52

Earlier quoted context omitted.

Attacks on port 22 end up consuming CPU.

fail2ban

And now you have another exploitable venue, the log parser of fail2ban ;).

Personally, I trust netfilter/iptables' rate limiting more.

Re: Why Putting SSH On Another Port is a Good Idea

#128

Post by serans »

relix wrote: post #113
cldr wrote: post #2

Ouch, camouflage on a tank is a good analogy. Nice response post. In addition to, as the author encourages, being "weary of the 'by obscurity'" argument (as I'm sure we all already are), I would also advocate being wary of it :)

No it isn't. Every server runs SSH, so this is more like there's a field, and you know there's a tank in the field, but you can't see it. The next thing you do then is take out your standard radar device which scans the field, and pinpoints exactly where the tank is in 3 seconds, and then you aim your tank buster at that spot and fire.

In my experience most of the time "attackers"/script-kiddies just scan over a range of IPs for port 22, and if it's not open on your computer, they just move on to the next IP. That's why you get thousands of requests for port 22 and very few on say port 21.

Of course, not that it would stop someone willing to spend more than a few seconds on attacking your server, but still makes the camo analogy a quite nice one in my opinion.

Re: Why Putting SSH On Another Port is a Good Idea

#129

Post by peterwwillis »

quesera wrote: post #62
sarnowski wrote: post #43

The "change-port" discussion for SSH is so boring :-/ OpenSSH is I guess the most secure daemon on all your servers. People should more think about to change the HTTP(S) ports of their non-public facing sites and other daemons and frameworks they use.

> OpenSSH is I guess the most secure daemon on all your servers. Probably correct. However, sshd should be the only public facing daemon that hasn't dropped root privileges immediately after binding to its privileged port. So it should be the only daemon that can directly offer root privs to an attacker. I say "should" because it's a big world out there and people do some bizarre and indefensible things. Sometimes me…

It is almost the same thing to offer non-root privs, because of the great number of patched and unpatched priv escalation holes in Linux. Almost guaranteed you will be able to get root if you get normal user privs.

Re: Why Putting SSH On Another Port is a Good Idea

#130

Post by teddyh »

jvdh wrote: post #107
abalone wrote: post #80

He's overreacting a bit. Port knocking is not just an "obscurity layer". It's more akin to a PIN or weak password. The condescending opening is a tip off ("people who almost understand the topic").

Even so, it is still a very weak security layer that you are adding on to something that is already very secure. Does that really make it less secure? Now running SSH on a different port is an even weaker obscurity layer, but still, it still adds some security.

I think nobody is denying that it adds security. The question is, does the added security offset the increased complexity and associated difficulties?
Post reply on HN