Why putting SSH on another port than 22 is bad idea • Hacker News Board

Re: Why putting SSH on another port than 22 is bad idea

#61

Post by Aqueous » Sat, Oct 26, 2013, 4:24 PM UTC

thirsteh wrote: post #58

Aqueous wrote: post #57

Earlier quoted context omitted.

I don't see what moving it to 2222 does that turning off password authentication, requiring public key authentication disallowing remote root login, and fail2banning repeated login attempts doesn't.. Is there a vulnerability in SSH or our asymmetric key cryptography that I don't know about(other than the one possibly introduced to the random number generator)? If there is, is the NSA less likely to use 2222 to knock…

Even if that's the only thing, that's not useless. Just don't mistake it for a security measure. Also, you can put port numbers in your SSH config, so you never have to type them.

I move from computer to computer a lot and don't take my SSH config with me. Typing the extra -p 2222 is tedious when it doesn't give me any benefit.

The only thing moving the SSH daemon does is give us a slight, conditional performance benefit (that using fail2ban on port 22 also gives, along with an actual security benefit). It does not give us any security benefit at all.

Re: Why putting SSH on another port than 22 is bad idea

#62

Post by Aqueous » Sat, Oct 26, 2013, 4:37 PM UTC

ericd wrote: post #22

thirsteh wrote: post #16

Earlier quoted context omitted.

Stop trying to make it so cut-and-dry. This is not pure cryptography where the adage actually applies (a cryptographic construction should remain secure if everything about it except the key is known.) You shouldn't mistake obscurity for security, but obscurity that doesn't actively bother the user doesn't hurt security. Again, emphasis on not mistaking obscurity for security, i.e. moving SSH to a port other than 22…

Good rebuttal. Maybe we should start downvoting so that this truism that constantly gets trotted out can go away. On the other hand, your explanation plus the other replies probably help people dispel this notion for others, so maybe it's good to keep this kind of thing coming around.

It gets trotted out for a reason - because it is true.

All the change of port does is reduce the load avg from brute force attacks and failed connection attempts. You can accomplish the same thing with a fail2ban rule on the standard port.

Changing the port doesn't prevent intrusions. That's not a security benefit. That's a performance benefit, and a short-lived one at that, since what do you think botnet hackers will do once they've figured out that we're all running SSHd on a non-standard port and their brute force success rate goes to zero? They're going to adapt to the situation and scan the machine before connecting to it.

It's not security if it doesn't give a guarantee. Changing the port guarantees nothing.

Re: Why putting SSH on another port than 22 is bad idea

#63

Post by ericd » Sun, Oct 27, 2013, 7:33 AM UTC

Aqueous wrote: post #62

ericd wrote: post #22

Earlier quoted context omitted.

Good rebuttal. Maybe we should start downvoting so that this truism that constantly gets trotted out can go away. On the other hand, your explanation plus the other replies probably help people dispel this notion for others, so maybe it's good to keep this kind of thing coming around.

It gets trotted out for a reason - because it is true. All the change of port does is reduce the load avg from brute force attacks and failed connection attempts. You can accomplish the same thing with a fail2ban rule on the standard port. Changing the port doesn't prevent intrusions. That's not a security benefit. That's a performance benefit, and a short-lived one at that, since what do you think botnet hackers wil…

You're right that it doesn't prevent intrusions from someone who's focusing on your machine, but doing something unusual that requires extra steps of attackers does usually decrease the likelihood of intrusions, especially from automated means. You're acting like bots frequently portscan when trying to brute force ssh, and I can tell you that they generally don't.

I typically don't bother, and just use fail2ban, but it's silly to say that it doesn't make it more secure. It does, if only marginally. As long as people are aware that it isn't sufficient, and that they still need to use strong passwords and/or public key auth, then there's no problem with saying that this makes things more secure.

Re: Why putting SSH on another port than 22 is bad idea

#64

Post by summerdown2 » Sun, Oct 27, 2013, 2:45 PM UTC

danielrm26 wrote: post #35

Here's my response to this, point by point: http://www.danielmiessler.com/blog/putting-ssh-another-port-...

I'm not sure your comment about the ability of a user to create a daemon on another port being the same regardless is correct:

> He claims that you shouldn’t run your SSH daemon on a non-privileged port because anyone can spin up a daemon up there. Great point, except you can still do that even if you run your main one on 22.

... surely the point here is that this is not an internal server (if it were, you wouldn't be getting tens of thousands of attacks in your example).

So in the case of a server running on port 22, someone with user level access couldn't set up a daemon running on port 2222 because it wouldn't be allowed through the external firewall. Put ssh on 2222, and you just opened the firewall for a port any user can open.

I agree with a lot of your other comments, though.