3 ms·
Changed SSH port is not security measure. It's needed to keep your log files clear from random network scanning. When your SSH port is something like 53148 and
by SXX 11y ago
Changed SSH port is not security measure. It's needed to keep your log files clear from random network scanning.
When your SSH port is something like 53148 and you see password brute-force activity in logs it's almost always mean that somebody intentionally scanning your server.
- zifnab06 11y agoJust a note: if you do change it, keep it below 1024. Otherwise if ssh dies anyone on the server can create a client listening on that port and steal credentials.
- acdha 11y agoThat's a somewhat obsolete belief – people have been scanning arbitrary ports for many, many years and SSH daemons helpfully announce themselves to search engines: https://www.shodan.io/report/uMZDnWfT https://www.shodan.io/report/uMZDnWfT This is a long-running problem and one with various popular solutions: restrict the source networks which you accept traffic for, disable password authentication entirely, and add some sort of rate limiting (e.g. 2004's fail2ban) for failures. Trying to reduce log volume by obscurity is futile - you really need to address the root problem and use tools which allow you to filter and aggregate effectively.