3 ms·
IMO it's already a bad practice to have SSH listening on a publicly accessible interface on port 22.
by inferiorhuman 10y ago
IMO it's already a bad practice to have SSH listening on a publicly accessible interface on port 22.
- petre 10y agoYeah? Then privision a new box and try to ssh to it with port 22 blocked. I could of course run fail2ban or a firewall rule in order to block at 3 failed attempts to connect and still run on port 22. Or use port knocking.
- inferiorhuman 10y agoOr just use an alternate port. There are, what, 65533 alternate ports available? > Then privision a new box and try to ssh to it with port 22 blocked. Shouldn't be a problem if you've got your provisioning stuff set to configure ssh on an alternate port. > I could of course run fail2ban or a firewall rule in order to block at 3 failed attempts A good idea, but still an additional step beyond simply using a different port. > and still run on port 22 And you'll still end up on the receiving end of more malicious traffic than if you'd not used port 22. > Or use port knocking. Not necessarily a bad idea, but still far more complex than simply using a non-default port. Same reason that many ISPs (including Amazon) place more restrictions on port 25 than other ports commonly used for SMTP traffic.