71–80 of 192 posts
Running services on non-standard ports will make the next admin that takes over this server want to track you down and smother you in your sleep.
(Actually, I appear to have stopped doing this. But it's something to consider if you are on weird networks on a regular basis.)
Ouch, camouflage on a tank is a good analogy. Nice response post. In addition to, as the author encourages, being "weary of the 'by obscurity'" argument (as I'm sure we all already are), I would also advocate being wary of it :)
2. Next he talks about this non-root listener issue. He claims that you shouldn’t run your SSH daemon on a non-privileged port because anyone can spin up a daemon up there. Great point, except you can still do that even if you run your main one on 22. I don't think I understand this point at all. What is it that you're trying to say? Are you sure you understood the original post's point? djc@capelis.dj:~$ nc -l -p 14…
If you have random people spinning up daemons on your servers then you don't have an SSH problem.
The reason he's right is most attacks on SSH are one-dimensional. In most cases the dimension is IP range - an automated process moves from IP address to IP address examining port 22 for any common vulnerabilities. Rarely do these processes check all ports. Moving your SSH deamon to a different port prevents those automated processes from then hitting your security layer on whichever port you are running. The other d…
Turning off passwords and only using keys also mitigates the standard brute force attacks that happen. Frankly I'd much rather do that then have my server on a non-standard port.
Frankly, the problems with key security and management are much worse than are being discussed. Using only keys is fine as long as your keys are secure and you know which is which and control all access and immediately remove any key which needs to be. In a complex environment, this is extremely difficult and more prone to security breaches than password access.
Earlier quoted context omitted.
Well, apparently with Zmap [1] you can do internet-wide scans in less than an hour from a single host, so I can't imagine they'd have that much trouble finding any open SSH ports on a smaller IP range. So just changing the SSH port will do little, but enabling port knocking would help it stay hidden. 1. https://zmap.io/zmap-talk-sec13.pdf
"Less than an hour" is with gigabit internet, which is rare for an attacker to have.
The condescending opening is a tip off ("people who almost understand the topic").