while I agree with most of the things in this article, he states the obvious...
Don't understand how this article got to the main page and it's still here after more than 11 hours.
Why Putting SSH On Another Port is a Good Idea
141–150 of 192 posts
Re: Why Putting SSH On Another Port is a Good Idea
#1422. Next he talks about this non-root listener issue. He claims that you shouldn’t run your SSH daemon on a non-privileged port because anyone can spin up a daemon up there. Great point, except you can still do that even if you run your main one on 22. I don't think I understand this point at all. What is it that you're trying to say? Are you sure you understood the original post's point? djc@capelis.dj:~$ nc -l -p 14…
Run it on a port where (port != 22 && port I run my SSH daemons on port 1022. It reduces brute-force attacks significantly without reducing security in any way that I'm aware of. I also have a ~/.ssh/config file in my laptop that tells SSH to use port 1022 whenever I'm connecting to one of my own remote machines so I don't even need to type anything extra when I use ssh, rsync, etc.
Ideally, you can run both https:// and ssh:// on 443, with sslh.
Everyone who's expecting to see HTTPS will see it on :443 as well.
Re: Why Putting SSH On Another Port is a Good Idea
#143As I understand his argument, it’s “Changing port number add security, therefore it’s a good idea.” I think nobody argues that it adds security . The problem is that: 1. It adds very little security: 16 bits is not much, and the result is not 256 bits (say) of SSH key plus 16 bits equals 272 bits, but instead effectively still 256 bits, or 256+8×10⁻⁷³ bits. 2. The security it adds is itself bad (sent in cleartext, ea…
I changed it because it makes FreeBSD's nightly security run output not contain thousands of lines like this: Jul 28 23:53:57 hostname sshd[1068]: Failed keyboard-interactive/pam for root from 78.129.252.154 port 55040 ssh2 Jul 28 23:53:58 hostname sshd[1076]: Failed keyboard-interactive/pam for root from 78.129.252.154 port 55155 ssh2 Jul 28 23:53:58 hostname sshd[1076]: Failed keyboard-interactive/pam for root from…
Here is an even worse log output nightmare: Enable logging in the firewall/ids, which show all packets sent to a closed port.
It's massive. Endless. Like looking into the endless void.
Of course, my computer does not log packets that are just bouncing against my computer. It would distract me too much, and maybe it would do so for you to. Easier just to tell the computer to not bug you about it, and trust that the "attack" is harmless enough so to not to bother logging it at all.
Re: Why Putting SSH On Another Port is a Good Idea
#144Earlier quoted context omitted.
I changed it because it makes FreeBSD's nightly security run output not contain thousands of lines like this: Jul 28 23:53:57 hostname sshd[1068]: Failed keyboard-interactive/pam for root from 78.129.252.154 port 55040 ssh2 Jul 28 23:53:58 hostname sshd[1076]: Failed keyboard-interactive/pam for root from 78.129.252.154 port 55155 ssh2 Jul 28 23:53:58 hostname sshd[1076]: Failed keyboard-interactive/pam for root from…
Here is an even worse log output nightmare: Enable logging in the firewall/ids, which show all packets sent to a closed port. It's massive. Endless. Like looking into the endless void. Of course, my computer does not log packets that are just bouncing against my computer. It would distract me too much, and maybe it would do so for you to. Easier just to tell the computer to not bug you about it, and trust that the "a…
This is the default email that a freshly installed FreeBSD sends you every night. It also contains a bunch of other bits. That's a bit different than subscribing to firewall spam.
Re: Why Putting SSH On Another Port is a Good Idea
#145There's nothing inherently good or bad about running SSH on another port. Honestly this argument is a bit silly given how easy it is to port-scan and many scripts out there will do that before actually trying anything. Essentially all you're going to do is make things annoying for your users.
The really real good idea is running a VPN in front of all of your servers and never allowing SSH access to the outside world. I have two ports (at most) open on all of my servers: 80 and 443. OpenVPN takes less than an hour to setup. There's no reason not to set it up!
Re: Why Putting SSH On Another Port is a Good Idea
#146As I understand his argument, it’s “Changing port number add security, therefore it’s a good idea.” I think nobody argues that it adds security . The problem is that: 1. It adds very little security: 16 bits is not much, and the result is not 256 bits (say) of SSH key plus 16 bits equals 272 bits, but instead effectively still 256 bits, or 256+8×10⁻⁷³ bits. 2. The security it adds is itself bad (sent in cleartext, ea…
I changed it because it makes FreeBSD's nightly security run output not contain thousands of lines like this: Jul 28 23:53:57 hostname sshd[1068]: Failed keyboard-interactive/pam for root from 78.129.252.154 port 55040 ssh2 Jul 28 23:53:58 hostname sshd[1076]: Failed keyboard-interactive/pam for root from 78.129.252.154 port 55155 ssh2 Jul 28 23:53:58 hostname sshd[1076]: Failed keyboard-interactive/pam for root from…
So does this:
ChallengeResponseAuthentication no
PasswordAuthentication no
Re: Why Putting SSH On Another Port is a Good Idea
#147Earlier quoted context omitted.
those numbers don't look good at when you take a look at what those two classes of people are doing. ie. 1. is targeting you specifically, 2. is bot targeting everyone when presented with two options, thinking of those options as 50:50 is natural, but it's really more like 0.0000001:99.9999999
A bot doesn't necessarily only scan port 22 in a range - nothing stops the bot herder making it scan 1-1024 instead.
Yes there is. It's called economics.
Re: Why Putting SSH On Another Port is a Good Idea
#148As I understand his argument, it’s “Changing port number add security, therefore it’s a good idea.” I think nobody argues that it adds security . The problem is that: 1. It adds very little security: 16 bits is not much, and the result is not 256 bits (say) of SSH key plus 16 bits equals 272 bits, but instead effectively still 256 bits, or 256+8×10⁻⁷³ bits. 2. The security it adds is itself bad (sent in cleartext, ea…
>1. It adds very little security: 16 bits is not much, and the result is not 256 bits (say) of SSH key plus 16 bits equals 272 bits, but instead effectively still 256 bits, or 256+8×10⁻⁷³ bits.
Aren't there rate limiting tricks you can use to impose great cost on searching for the correct port?
Re: Why Putting SSH On Another Port is a Good Idea
#149There's nothing inherently good or bad about running SSH on another port. Honestly this argument is a bit silly given how easy it is to port-scan and many scripts out there will do that before actually trying anything. Essentially all you're going to do is make things annoying for your users. The really real good idea is running a VPN in front of all of your servers and never allowing SSH access to the outside world.…
Agreed, VPN via physical firewall is a particularly nice solution.
Sounds like you've offloaded mail, dns, etc. elsewhere if you only have at most 80 and 443 open.
Re: Why Putting SSH On Another Port is a Good Idea
#150a: $port != 22 is enough to thwart most bots and skiddies. If you think the port number is a guarantee that you are safe or that you are communicating with a blessed ssh you are sadly mistaken. b: Uhh the port number means nothing. Host keys are there for a reason... Someone does not understand the functions of SSH. http://www.snailbook.com/ c: If you are not investigating fingerprint issues when logging in via SSH a…
Sorry for deviating for the topic, but I think it must be said: "Sorry for the snarky reply" is not enough, considering that you wrote it at the same time you could have gone back and rewrite the text into a polite, well-worded argument. That's just condescension - if you really were sorry, you'd have rewritten your text. By replying like that you've ensured that your point won't come across - for all I know you migh…
"Sorry for the snarky reply" is not enough, considering that you wrote it at the same time you could have gone back and rewrite the text into a polite, well-worded argument. That's just condescension - if you really were sorry, you'd have rewritten your text."
You are right. I am not sorry for the snarky reply.
"By replying like that you've ensured that your point won't come across - for all I know you might be technically right, but using that tone ensures that lots of people will refuse to read past the second paragraph."
Okay.
"If your argument is solid, that's all you need. IMHO, snark makes your point come across as bragging, and no one likes that."
Okay.