On my personal boxes I use a combination of non-standard ports, disabling password auth (seriously, this will do more for your security than anything else), and fail2ban. Even with key authentication fail2ban still blocks several IPs a day.
Why Putting SSH On Another Port is a Good Idea
41–50 of 192 posts
Re: Why Putting SSH On Another Port is a Good Idea
#42Thanks for writing up the same response I had to that article.
Re: Why Putting SSH On Another Port is a Good Idea
#43The "change-port" discussion for SSH is so boring :-/ OpenSSH is I guess the most secure daemon on all your servers. People should more think about to change the HTTP(S) ports of their non-public facing sites and other daemons and frameworks they use.
Re: Why Putting SSH On Another Port is a Good Idea
#44Earlier quoted context omitted.
Exploiting a single user's account and opening a high port is not the same as getting root on a system.
So you're operating with a compromised user account capable of killing your sshd on port 1234 but there's no other local escalation exploits? Seems like something a little script or patch could fix up really easily - make sure your daemon is running on port 1234. If it's not, take whatever defensive measures you think would be effective.
Or instead of doing a script or a patch, you could just do the right thing in the first place and run your daemon on any of the literally over one thousand ports set aside for privileged services.
Re: Why Putting SSH On Another Port is a Good Idea
#452. Next he talks about this non-root listener issue. He claims that you shouldn’t run your SSH daemon on a non-privileged port because anyone can spin up a daemon up there. Great point, except you can still do that even if you run your main one on 22. I don't think I understand this point at all. What is it that you're trying to say? Are you sure you understood the original post's point? djc@capelis.dj:~$ nc -l -p 14…
Privileged ports are why I disagree with this rebuttal. I want some assurance that when I ssh into a box, that I'm hitting a true and sanctioned sshd.
Then bind to another port under 1024, so it's privileged, but not port 22.
Re: Why Putting SSH On Another Port is a Good Idea
#46Earlier quoted context omitted.
> I want some assurance that when I ssh into a box, that I'm hitting a true and sanctioned sshd. You don't get that from it being on 22; you get it from verifying host keys.
> You don't get that from it being on 22; you get it from verifying host keys. You know how you just wrote a blog post talking about how more layers of security are better even if all you're gaining is obscurity ? This isn't an exception. And it is a valid point that by moving from a privileged port to a non-privileged port, you just traded away a layer (arguably a more useful one than you gain by moving away from 22…
Ok, fair point.
I'd say it differently, though. Instead of defending the original point, which was bad, I'd instead say among all other controls--most important of which is patching, removing passwords, etc.--one control is running below 1024.
I could go for that.
Except I actually think the gain from being up high (over 60K) is greater than the gain from being below 1024. It's not about being invincible, it's about not being a target at all.
Re: Why Putting SSH On Another Port is a Good Idea
#47Earlier quoted context omitted.
So you're operating with a compromised user account capable of killing your sshd on port 1234 but there's no other local escalation exploits? Seems like something a little script or patch could fix up really easily - make sure your daemon is running on port 1234. If it's not, take whatever defensive measures you think would be effective.
Or instead of doing a script or a patch, you could just do the right thing in the first place and run your daemon on any of the literally over one thousand ports set aside for privileged services.
Running on a privileged port doesn't change which other hosts can connect to the privileged server though. At best it tells the client that the server is probably running as root (or has the appropriate capability bit).
If you're worried about an impostor sshd on that host then I would tend to agree that it's simply not prudent to be connecting to that server at all, let alone passing key material or credentials.
Re: Why Putting SSH On Another Port is a Good Idea
#48Anyone use Dome9? (http://dome9.com) they close all of your ports and open them on demand via chrome extension or mobile app for when you want to use SSH.
Re: Why Putting SSH On Another Port is a Good Idea
#49Here is something to think about, the author is right, but if you follow many ssh setup tutorials that say to move to say port 25000, you are less likely to be port scanned than the default, but still more likely than if you had used something totally random like say port 42 or 818. By me even writing this clever hackers will start scanning those ports too, just to be sure they are hitting everyone. That being said,…
Port scanning is generally automated (edit: and scans all ports, not just the handful you listed), so it doesn't actually matter which port you pick as long as it's not 22. Port scanners like nmap are widely available, so the time to actually figure out which port is running SSH is quite short in practice. Basically, there are two classes of people: 1. Those who use port scanners. 2. Those who do not. If you are bein…
those numbers don't look good at when you take a look at what those two classes of people are doing.
ie. 1. is targeting you specifically, 2. is bot targeting everyone
when presented with two options, thinking of those options as 50:50 is natural, but it's really more like 0.0000001:99.9999999
Re: Why Putting SSH On Another Port is a Good Idea
#50I run SSH on port 22, but occasionally (when I travel) I will run it on port 443. Yes, know 443 is used by HTTPS, but:
1) I don't run HTTPS on the box I SSH into
2) I might hit an overly restrictive WiFi that only allows traffic out over HTTP and HTTPS
Which is another reason why you might not want to run SSH on another port. You might not be able to reach it.