20 ms·

How SSH got port number 22

1034 points by kissgyorgy 10y ago

swalsh 10y ago
I would have thought the reason it was chosen is that he assumed people had a firewall exception for the range of ports between 21 and 23, and by choosing 22 nothing had to be changed on the firewall.
- ams6110 10y ago
  There weren't nearly as many people running firewalls in 1995. But you may be right.
  - DonHopkins 10y ago
    The firewall extinguisher hadn't even been invented yet.
mjn 10y ago
Minor side bit here, > The number should preferably be in the range 1-255 so that it can be used in the WKS field in name servers. Well-known service (WKS) records let hosts advertise in DNS which services a given machine made available, by listing which of the assigned port numbers were open for TCP or UDP connections. This never really caught on, as few people used them, even fewer kept them up to date, and checking WKS provided very little real benefit over just attempting a connection. They had been deprecated already in 1989 through RFC 1123 [1], but it seems that by the mid-1990s at least some people still considered them relevant. [1] "An application SHOULD NOT rely on the ability to locate a WKS record containing an accurate listing of all services at a particular host address, since the WKS RR type is not often used by Internet sites. To confirm that a service is present, simply attempt to use it." https://www.ietf.org/rfc/rfc1123.txt https://www.ietf.org/rfc/rfc1123.txt
- nodesocket 10y ago
  Thanks, I was curious what WKS was.
- derefr 10y ago
  How similar/different is WKS to the modern SRV record?
  - Crespyl 10y ago
    IIUC, WKS was basically just a list of ports you could expect to be open on a host, while SRV allows you to indicate a separate server to handle a given service. Wikipedia[0] has the example of a SIP telephony server, `example.com` sets a SRV record that redirects interested clients to `sipserver.example.com`. [0]https://en.wikipedia.org/wiki/SRV_record https://en.wikipedia.org/wiki/SRV_record
    - mjn 10y ago
      Yeah, there's no pointing to other hosts in WKS, just information on the host itself. I believe it come out of ideas about service discovery in the early days of the internet, when you might know of 100 other hosts, but not know which ones ran SMTP, FTP, etc. The WKS records would let you get a map of the net's services by doing a bunch of DNS lookups instead of having to portscan everyone. SRV records are more like an MX record generalized to arbitrary services, allowing a domain to point to the hosts that provides various services for that domain.
lindner 10y ago
For the record Gopher used port 150 for some time until we got a warning from Joyce that we had to change it. Registering MIME types was also easy: https://www.iana.org/assignments/media-types/application/msword https://www.iana.org/assignments/media-types/application/msw...
- uiri 10y ago
  I take it this prompted the change to port 70. Why 70? What other protocol was using port 150 at the time?
  - qbrass 10y ago
    SQL apparently. https://tools.ietf.org/html/rfc1060 https://tools.ietf.org/html/rfc1060 first mention of port 150 being used
    - derefr 10y ago
      Was there, at one point, an "SQL protocol"? Because there isn't any standardized SQL wire-protocol today.
- rschoultz 10y ago
  Yes I remember that, and also http was on port 82 before it was assigned 80, if memory serves me right. I reserved port 63 for whois++, that by the way rests fine where it is, in very few people's memories, during the same era. The motivation went something like 43 for whois protocol, 53 for ns, so 63 looks like evolution, though there were no aspirations to replace the name service protocol.
pbhjpbhj 10y ago
It's not a terribly interesting story IMO. The author (Tatu Ylonen) sent an email to Joyce K. Reynolds at IANA, on release of v.1.0 of SSH protocol, and IANA agreed to assign port 22. That's kinda it. A summary of SSH use follows the story which is a good overview for someone new to it.
- beaconstudios 10y ago
  I think it's interesting for how simple and informal it was in 1995. I always imagined that port allocation was a much more formal process more akin to an ISO or ECMA standardisation, but nope - Tatu sent an email asking for it and Joyce basically just replied with "sure thing, it's yours". For something as critical as port allocation it's pretty interesting/funny how casual it was.
  - zb 10y ago
    The process hasn't really changed much (I applied for a port allocation 5 years or so ago). There's a little questionnaire you fill out, and there might be some back-and-forth over email to clarify the answers but basically it's no more complicated than you email someone and if you fit the criteria they reply with your port allocation. What has changed is that there is essentially no chance of getting a privileged port allocated now.
    - hirsin 10y ago
      Yep it's still very easy and informal. I did it a year or two back to get a DNS-SD entry [1] defined. Just fill out the form [2] and do some back and forth - even updating it is easy. Also yes, a dedicated port is very hard to get - you thought IPv4 was running out ;) One of the side effects of them being such a widespread and networked group is that when I made my application, they suggested I go talk to one of my coworkers (as loosely defined as that is at Microsoft) since he helped standardize the body anyhow. A bit of zen - "the answers you seek were within you[r org chart] the whole time" 1. https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=wdp https://www.iana.org/assignments/service-names-port-numbers/... 2. https://www.iana.org/form/ports-services https://www.iana.org/form/ports-services
chiph 10y ago
Different era, when you could accomplish wide-ranging changes just by sending an email. These days a committee would have to be appointed.
- user5994461 10y ago
  It's still the same, send emails to the committee members. There are just more people in copy :D
  - coldtea 10y ago
    Yeah, and good luck if you're not Google or similarly sized.
    - V99 10y ago
      I got a port assigned for our startup 2 years ago with one email and one follow-up response to a couple questions. It's really not that hard. (https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=9345 https://www.iana.org/assignments/service-names-port-numbers/...)
    - Analemma_ 10y ago
      The issue isn't the committees - as V99 said, IANA will assign you a port without too much hassle if you just ask. The real issue is stupid middleware boxes and overzealous cargo-cult-security sysadmins who block every port except 22, 80 and 443. Getting new applications with new ports to work on the real Internet is rarely worth the hassle, which is why now we have to tunnel every new protocol over HTTP.
teddyh 10y ago
> Anyway, I designed SSH to replace both telnet (port 23) and ftp (port 21). That sounds weird. Did SSH originally have file-copying capabilities? As I recall, the ssh command was written to be command-line compatible with rsh, not telnet, since rsh (and its companion rlogin) was what people were using at the time to log in over the network between local systems. The manual page for SSH still states this explicitly: “It is intended to replace rlogin and rsh […]”, and SSH from the start had (and still has) an rlogin replacement, "slogin". (Telnet was at the time only used for accessing remote, i.e. not-on-site, services, which did not necessarily imply shell access.) Anyway, the rsh and rlogin protocols use port 513 and 514, but no nearby ports seems to be unallocated. The story seems to be missing some details, or possibly be made up after the fact in lieu of a bad memory. It seemed reasonable to me at the time to give port 22 to a better replacement for, and a spiritual successor to, Telnet, but the story seems odd for not mentioning rsh or rlogin at all.
- rjsw 10y ago
  It still does have file-copying capabilities. See scp(1).
  - teddyh 10y ago
    Scp was, according to its manual page, based on rcp (part of the rsh/rlogin set of programs): “scp is based on the rcp program”.
    - rjsw 10y ago
      Sure, but scp uses the same port as ssh so the underlying protocol has to deal with both terminal and file copying commands.
    - caf 10y ago
      Well, yes, exactly: rsh, rlogin and rcp were often considered together, as they both used the same access control - /etc/hosts.equiv. So it's not that surprising that ssh, slogin and scp came together as a replacement set.
  - 10y ago
defined 10y ago
Maybe it's a subtle plug for CryptoAuditor and Universal Key Manager, products the author's company offers? > CryptoAuditor is a product that can control tunneling at a firewall or at the entry point to a group of cloud servers. It works together with Universal SSH Key Manager to gain access to host keys and is able to use them to decrypt the SSH sessions at a firewall and block unauthorized forwarding.
- deleted 10y ago
  [deleted]
jgrahamc 10y ago
A bigger question would be how did FTP get 21 and Telnet 23 leaving a gap for SSH?
- saltcured 10y ago
  Remembering how things worked bach then, someone probably invoked Catch-22...
- zorked 10y ago
  For some reason odd numbers are used more often than even. Ports 24, 26, 28, 30, 32, 34, 36 are all unassigned to this day.
  - rwmj 10y ago
    Because of the NCP protocol which preceded TCP. It used even port numbers for outgoing data and odd port numbers for incoming data. TCP used the same port numbers, but fully duplexed the data into a single port. The well-known incoming port numbers are therefore all odd (initially, the limitation no longer applies to TCP of course). https://en.wikipedia.org/wiki/Network_Control_Program https://en.wikipedia.org/wiki/Network_Control_Program
  - DonHopkins 10y ago
    That was to prevent homosocketuality. http://www.saildart.org/IMPSER.DOC[SS,SYS] http://www.saildart.org/IMPSER.DOC[SS,SYS] IGN 3 Illegal Gender (Anita Bryant feature--sockets must be heterosocketual, ie. odd to even and even to odd) The host is trying to engage us in homosocketuality. Since this is against the laws of God and ARPA, we naturally refuse to consent to it. http://www.saildart.org/FTP.NCP[S,NET] http://www.saildart.org/FTP.NCP[S,NET] gayskt: outstr [asciz/Homosocketuality is prohibited (the Anita Bryant feature)
ohlookabird 10y ago
Off topic, but maybe someone has an explanation to one thing that I wondered quite a few times on mailing lists and that I got reminded of by the E-mail Tatu Ylonen sent to Joyce K. Reynolds: Why is it that some people start their E-mail with "Dear Sir"? From where comes the (to me unreasonable) expectation that there is a single male person on the other end (instead of a mixed group)? Are there stereo-types at play or is this a language/translation thing?
- deleted 10y ago
  [deleted]
- deleted 10y ago
  [deleted]
- ams6110 10y ago
  Assuming you are not a native speaker since you mention language/translation, at the time it was a common salutation when one didn't know the name of the person(s) who would be reading your letter. Gender was not implied. Sometimes people would use "Dear Sir or Madam" but that's more clumsy. I was always taught in school that "he/him/his" was gender neutral if there was no context indicating otherwise. People have started to get more and more annoyed by this, leading to the grammatically incorrect usage of "them/they." Anyone who went to school or learned English in 1980s or earlier would have had learned "Dear Sir" as the standard generic salutation when writing a professional letter. I suppose today one would start such a letter with "Dear Person." That sounds somehow disrespectful to me. There's always "To whom it may concern."
  - uiri 10y ago
    them/they as a gender neutral singular pronoun is not grammatically incorrect. Wikipedia has a rather extensive article on its history and usage. Criticism of this usage as incorrect only arose in the late 19th century. https://en.wikipedia.org/wiki/Singular_they https://en.wikipedia.org/wiki/Singular_they
    - ams6110 10y ago
iagooar 10y ago
I wonder if there will be a new invention like the Internet during my lifetime, where I can actually participate in shaping and defining it. While I grew up with computers, when Internet got to the first homes like mine, I was still too young and had only very limited programming skills to contribute to it. Love these stories about how simple and straight-forward it was to have a huge impact. I guess there is some nostalgia involved, but these were, in my opinion, better times.
- StavrosK 10y ago
  Maybe? The problem is that you can only shape it and define it when it's really small. Maybe one of the cryptocoins is it. Maybe it's Bitcoin, and you've already missed much of the boat. Who can tell? I think these things are a bit "right place right time". It has to be early enough that you can contribute, but that early and you never know if it's going to go anywhere. Any later, and the opportunity is gone.
- sbov 10y ago
  Mobile? Self driving cars?
- 300bps 10y ago
  Get into VR, AI or similar fields.
- lisper 10y ago
  > I wonder if there will be a new invention like the Internet during my lifetime, where I can actually participate in shaping and defining it. Almost certainly there will be multiple such inventions. Internet-magnitude inventions happen once every ten years or so. The trick is that such things are generally very hard to recognize while they are still small enough for an individual to make a significant contribution. It's often hard to recognize them even when you are in the middle of them. They are often lost in a sea of very similar looking things that end up going nowhere (e.g. https://en.wikipedia.org/wiki/List_of_home_computers https://en.wikipedia.org/wiki/List_of_home_computers). Being part of Something Big is largely a matter of luck. The best you can do is to stack the odds in your favor by hanging out some place that Cool Things Happen and never stop trying new things. But many people do that for a lifetime without catching a wave.
rwmj 10y ago
A more interesting story is why are the older services using mainly odd port numbers (ie. 21 = FTP, 23 = telnet, why was port 22 free at that time?). It turns out because the protocol which preceded the invention of TCP, called NCP, used even-odd pairs of port numbers, with even for "outgoing" data and odd for "incoming". So the well-known port numbers for incoming services were all odd. Sources: https://en.wikipedia.org/wiki/Network_Control_Program https://en.wikipedia.org/wiki/Network_Control_Program http://www.pcvr.nl/tcpip/introduc.htm http://www.pcvr.nl/tcpip/introduc.htm
- DonHopkins 10y ago
  Back in the "bad old days" of the simplex NCP protocol [1], before the full duplex TCP/IP protocol legalized same-sex network connections, connect and listen sockets had gender defined by their parity, and all connections were required to use sockets with different parity gender (one even and the other odd -- I can't remember which was which, or if it even mattered -- they just had to be different). The act of trying to connect an even socket to another even socket, or an odd socket to another odd socket, was considered a "peculiar error" called "homosocketuality", which was strictly forbidden by internet protocols, and mandatory "heterosocketuality" was called the "Anita Bryant feature" [2]. http://www.saildart.org/IMPSER.DOC[SS,SYS] http://www.saildart.org/IMPSER.DOC[SS,SYS] When the error code is zero, the next 8 bit byte is the Stanford peculiar error code, followed by 72 bits of the ailing command returned. Here are the Stanford error codes. [...] IGN 3 Illegal Gender (Anita Bryant feature--sockets must be heterosocketual, ie. odd to even and even to odd) [...] Illegal gender in RFC, host hhh/iii, link 0 The host is trying to engage us in homosocketuality. Since this is against the laws of God and ARPA, we naturally refuse to consent to it. http://www.saildart.org/FTP.NCP[S,NET] http://www.saildart.org/FTP.NCP[S,NET] ; Try to initiate connection loginj: init log,17 sixbit /IMP/ 0 jrst noinit setzm conecb setom conecb+lsloc move ac3,hostno movem ac3,conecb+hloc setom conecb+wfloc movei ac3,40 movem ac3,conecb+bsloc move ac3,consck trnn ac3,1 jrst gayskt ; only heterosocketuals can win! movem ac3,conecb+fsloc mtape log,[ =15 byte (6) 2,24,0,7,7 ] ; Time out CLS, RFNM, RFC, and INPut [...] gayskt: outstr [asciz/Homosocketuality is prohibited (the Anita Bryant feature) /] ife rsexec,<jrst rstart;>exit 1, (The PDP-10 code above adds the connect and listen socket numbers together, which results in bit 0 being 0 if they are the same gender, then TRNN is "test bits right, no change, skip if non zero", which skips the next instruction (jrst gayskt) if they different sex.) [1] https://en.wikipedia.org/wiki/Network_Control_Program https://en.wikipedia.org/wiki/Network_Control_Program [2] https://www.youtube.com/watch?v=H-A2Ql81WTY https://www.youtube.com/watch?v=H-A2Ql81WTY
arca_vorago 10y ago
You should not be afraid to change the port number either. As a sysadmin, I have heard all the tales of no security through obscurity, which honestly I don't think is nearly as steadfast a law as people pretend, but thats another discussion. Changing ports isn't about security, it's about log fatique. Less hits on different ports, less things to stop and investigate. Even better, port knocking on non-standard port.
- webwanderings 10y ago
  What's better - Fail2ban or change port?
  - TallGuyShort 10y ago
    Why not both? Changing the port is so trivially easy and just moves you out of the way of the majority of low-sophistication automated scans.
    - teddyh 10y ago
      (I repeat my comment from 3 years ago¹:) I think nobody argues that it adds security. The problem is that: 1. It adds very little security: 16 bits is not much, and the result is not 256 bits (say) of SSH key plus 16 bits equals 272 bits, but instead effectively still 256 bits, or 256+8×10⁻⁷³ bits. 2. The security it adds is itself bad (sent in cleartext, easily brute-forced) 3. These problems stand against the many drawbacks of this previously discussed (complexity, confusion, etc.). And the final argument: If increased security is what you want, simply increase your key lengths and/or password lengths, and you will get much more than 8×10⁻⁷³ bits of security, without any of the above problems. ① https://news.ycombinator.com/item?id=6617312 https://news.ycombinator.com/item?id=6617312
      - TallGuyShort 10y ago
        Did you reply to the right comment? Feels like you might have been addressing a different issue. There's more to security than information theory. Bits of security aside, if you're not listening on port 22 the majority of wide-scale automated scans miss you entirely. If there were some zero day being actively exploited in the wild, admins occasionally having to remember '2222' instead of '22' is pretty a pretty trivial issue and just sidesteps a lot to buy you some time to patch.
franciscop 10y ago
In my experience, if you ask nicely and have good intentions you can achieve A LOT of things that you might not expect at all.
- IAmGraydon 10y ago
  So true.
arielm 10y ago
Another important thing - when you want something you should ask for it. So many times I didn't ask because I _thought_ it wouldn't happen...
nepotism2016 10y ago
I was hoping for some epic Lord of the Rings story, disappointed...but SSH makes up for it :)
- tremendo 10y ago
  You mean like '*' the asterisk standing to mean "anything" being ASCII 42: the answer to Life, the Universe, and Everything.?
tmsldd 10y ago
If a Nobel prize equivalent existed for software developers to recognize their immense contribution to the field, Tatu Ylonen would deserve it for sure. It's great to know stories like this one.
- teddyh 10y ago
  The real reason for SSH being an immense contribution is that the OpenSSH fork happened when Tatu Ylönen made the original SSH program proprietary. Now that I think of it, I wish they had renamed it to something without "SSH" in the name, so he and the SSH Company couldn’t keep reaping name recognition benefits.
nathan_f77 10y ago
Wow, I had no idea that SSH had become such a huge security company [1], with 6 locations around the world. Another surprising thing is that it was only created in 1995. I was expecting it to be a few decades older. [1] https://www.ssh.com/ https://www.ssh.com/
- dreamcompiler 10y ago
  This is like discovering that air.com exists and is a vendor of breathable gases. (It does exist, but it appears to be a squatter domain for airline tickets.)
odbol_ 10y ago
That's pretty awful. I'm glad the industry is moving away from such discriminatory language. More recent examples of removing bias include: * Renaming master/slave to central/peripheral * Avoiding gender in code comments and documentation, e.g. "When user clicks, log him out" to "When user clicks, log them out". * Being able to disable animations globally, for epileptic users.
- halomru 10y ago
  How is Master/Slave discrimatory language? Who is discrimated there? In my eyes it is simply a factual description of an architecture: the master gives commands, the slave obeys. The slave doesn't act without permission from the master and only speaks when spoken to. I wish no such thing for any human, but it describes a great architecture for software and hardware.
  - Tenhundfeld 10y ago
    I don't want to get into an argument about discrimination and sensitivity and trigger words and all that. The real point here is that slave has a lot of meanings, currently and throughout history, and thus has a lot of baggage. A slave is not just someone/something that obeys or only speaks when spoken to. A slave is owned by its master. A slave is entirely under the domination of the master. That doesn't really map cleanly on to replication. A master database doesn't really own or control the slave database; it just provides a log of actions performed against it that the slave needs to mimic. As I understand history, the master/slave metaphor has been used for a long time in technology (e.g., in machinery and photography), well before computers or software, but we have better terminology. Many organizations use primary/replica or even just master/replica. Using replica instead of slave seems like an obvious win. It's more precise and clear, and it avoids the baggage. It's also more intuitive when you're using the slave DB for reporting, i.e., "read replica" makes more sense to me than "read slave". Maybe that's just me. I don't see a downside to using replica.
    - antongribok 10y ago
      While following this thread I found your comment initially jarring, because in my mind I was thinking of the ATA protocol and not databases. And it appears that neither are good examples. Perhaps not the best reference, but this Wikipedia page provides some examples as well as some info on the appropriateness of use that I found interesting: https://en.wikipedia.org/wiki/Master/slave_(technology) https://en.wikipedia.org/wiki/Master/slave_(technology)
paxcoder 10y ago
You shouldn't be. We have links for this. This is plagiarism.
- DonHopkins 10y ago
  It's not your job to tell other people what they should and shouldn't be interested in. Is your own discomfort from being shocked that TCP/IP allows homosocketuality, because you're "not a gay supporter", so seductively connecting innocent sockets of the same parity sickens you? Certainly your morality influences how you view things. We have links for this, to plagiarize your own words: https://news.ycombinator.com/item?id=6496756 https://news.ycombinator.com/item?id=6496756 "My question is honest. My provocation is meant for the soul. I am sorry for not being kind." https://news.ycombinator.com/item?id=13246410 https://news.ycombinator.com/item?id=13246410 "Please provoke souls somewhere else." -dang
  - paxcoder 10y ago
    I didn't say this shouldn't be of interest. I was defending the author of the original comment, which in light of the fact that both accounts belong to you means my intention was ensuring your attribution. I felt no discomfort here, though granted I haven't read the whole comment. "Same-sex network connections" gave me a chuckle - I assume a reference to the "male" and "female" hardware connectors. I was actually weighing on commending you for the joke before I found out the same words were used elsewhere by another account. I am surprised by the tone of your reply. I kind of hope most of my downvotes are from you then, as I would hate to see a rise in reposts. I also hope you have an automated way of finding non-positive comments, because knowing you went through them by hand would be somewhat discomforting. Now, my morality certainly should influence how I view things - that's what it's for. If it is the case that here lies your problem with me, you should be aware that when I say gay I don't have in mind the mere attraction to the same sex, but indulgence, the practice of sexual acts of this nature (which is closer to the original sexualized definition of the term). The distinction may appear subtle, but isn't really. The grave difference is between temptation and sin. In recognizing the difference, one may become accepting of the human without in process compromising that human's soul.
exabrial 10y ago
Port numbers as service locators is driving us to ipv4 exhaustion. We have 65535 port numbers available on each ipv4 address we could use to run a web server, but we only use 2 (443,80). That's 48bits of addressing information, which is a metric crap ton. I have a separate theory as to why ipv6 is being pushed so hard by advertising companies like Facebook, Google, and the US Government (CIA, NSA): it makes it very easy to casually track the number of hosts behind firewalls. While not impossible with ipv4 at the layer4 level using fingerprinting techniques, it's quite difficult to do at scale, is unreliable, and spoofable. Ipv6 makes this trivial for anyone, and will allow ip transit providers to scrape more information about users, even those encrypting layer5+ traffic.
- Hello71 10y ago
  privacy extensions
  - exabrial 10y ago
    I'm familiar with them, while they allow one to hide your MAC address, they still individually identify you. It's sort of how like Verizon was caught injecting an arbitrary, but unique, http header into their user's http traffic. While it didn't provide your actual identity, it allowed advertisers to sort your traffic very easily.
- tjoff 10y ago
  Is there any reason not to do NAT with ipv6 for the casual user?
killin_dan 10y ago
So there's actually not a story? I read the email and the dude just gives them that port assignment with no ceremony. I was hoping it would be more climactic. HN doesn't really seem concerned that all these titles are low-quality bait. Guess they're digging those page req numbers. Unfortunate how effective it is to just deceive your users.
emmelaich 10y ago
In a way it's pity it was so easy. /etc/services is now testament to a multitude of broken dreams.
hwestiii 10y ago
tl;dr - I asked for it. - They gave it to me.
gejjaxxita 10y ago
I am aged thirty and every day I use a technology that didn't exist when I was eight, furthermore this technology "feels" ancient to me. It's a bit cliche but the pace of innovation in our field (at least up to now), and the rate at which we get used to new things, is amazing.

1034 points by kissgyorgy 10y ago

I would have thought the reason it was chosen is that he assumed people had a firewall exception for the range of ports between 21 and 23, and by choosing 22 nothing had to be changed on the firewall.

ams6110 10y ago
There weren't nearly as many people running firewalls in 1995. But you may be right.
- DonHopkins 10y ago
  The firewall extinguisher hadn't even been invented yet.

mjn 10y ago

Minor side bit here, > The number should preferably be in the range 1-255 so that it can be used in the WKS field in name servers. Well-known service (WKS) records let hosts advertise in DNS which services a given machine made available, by listing which of the assigned port numbers were open for TCP or UDP connections. This never really caught on, as few people used them, even fewer kept them up to date, and checking WKS provided very little real benefit over just attempting a connection. They had been deprecated already in 1989 through RFC 1123 [1], but it seems that by the mid-1990s at least some people still considered them relevant. [1] "An application SHOULD NOT rely on the ability to locate a WKS record containing an accurate listing of all services at a particular host address, since the WKS RR type is not often used by Internet sites. To confirm that a service is present, simply attempt to use it." https://www.ietf.org/rfc/rfc1123.txt https://www.ietf.org/rfc/rfc1123.txt

nodesocket 10y ago
Thanks, I was curious what WKS was.
derefr 10y ago
How similar/different is WKS to the modern SRV record?
- Crespyl 10y ago
  IIUC, WKS was basically just a list of ports you could expect to be open on a host, while SRV allows you to indicate a separate server to handle a given service. Wikipedia[0] has the example of a SIP telephony server, `example.com` sets a SRV record that redirects interested clients to `sipserver.example.com`. [0]https://en.wikipedia.org/wiki/SRV_record https://en.wikipedia.org/wiki/SRV_record
  - mjn 10y ago
    Yeah, there's no pointing to other hosts in WKS, just information on the host itself. I believe it come out of ideas about service discovery in the early days of the internet, when you might know of 100 other hosts, but not know which ones ran SMTP, FTP, etc. The WKS records would let you get a map of the net's services by doing a bunch of DNS lookups instead of having to portscan everyone. SRV records are more like an MX record generalized to arbitrary services, allowing a domain to point to the hosts that provides various services for that domain.

lindner 10y ago

For the record Gopher used port 150 for some time until we got a warning from Joyce that we had to change it. Registering MIME types was also easy: https://www.iana.org/assignments/media-types/application/msword https://www.iana.org/assignments/media-types/application/msw...

uiri 10y ago
I take it this prompted the change to port 70. Why 70? What other protocol was using port 150 at the time?
- qbrass 10y ago
  SQL apparently. https://tools.ietf.org/html/rfc1060 https://tools.ietf.org/html/rfc1060 first mention of port 150 being used
  - derefr 10y ago
    Was there, at one point, an "SQL protocol"? Because there isn't any standardized SQL wire-protocol today.
rschoultz 10y ago
Yes I remember that, and also http was on port 82 before it was assigned 80, if memory serves me right. I reserved port 63 for whois++, that by the way rests fine where it is, in very few people's memories, during the same era. The motivation went something like 43 for whois protocol, 53 for ns, so 63 looks like evolution, though there were no aspirations to replace the name service protocol.

pbhjpbhj 10y ago

It's not a terribly interesting story IMO. The author (Tatu Ylonen) sent an email to Joyce K. Reynolds at IANA, on release of v.1.0 of SSH protocol, and IANA agreed to assign port 22. That's kinda it. A summary of SSH use follows the story which is a good overview for someone new to it.

beaconstudios 10y ago
I think it's interesting for how simple and informal it was in 1995. I always imagined that port allocation was a much more formal process more akin to an ISO or ECMA standardisation, but nope - Tatu sent an email asking for it and Joyce basically just replied with "sure thing, it's yours". For something as critical as port allocation it's pretty interesting/funny how casual it was.
- zb 10y ago
  The process hasn't really changed much (I applied for a port allocation 5 years or so ago). There's a little questionnaire you fill out, and there might be some back-and-forth over email to clarify the answers but basically it's no more complicated than you email someone and if you fit the criteria they reply with your port allocation. What has changed is that there is essentially no chance of getting a privileged port allocated now.
  - hirsin 10y ago
    Yep it's still very easy and informal. I did it a year or two back to get a DNS-SD entry [1] defined. Just fill out the form [2] and do some back and forth - even updating it is easy. Also yes, a dedicated port is very hard to get - you thought IPv4 was running out ;) One of the side effects of them being such a widespread and networked group is that when I made my application, they suggested I go talk to one of my coworkers (as loosely defined as that is at Microsoft) since he helped standardize the body anyhow. A bit of zen - "the answers you seek were within you[r org chart] the whole time" 1. https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=wdp https://www.iana.org/assignments/service-names-port-numbers/... 2. https://www.iana.org/form/ports-services https://www.iana.org/form/ports-services

chiph 10y ago

Different era, when you could accomplish wide-ranging changes just by sending an email. These days a committee would have to be appointed.

user5994461 10y ago
It's still the same, send emails to the committee members. There are just more people in copy :D
- coldtea 10y ago
  Yeah, and good luck if you're not Google or similarly sized.
  - V99 10y ago
    I got a port assigned for our startup 2 years ago with one email and one follow-up response to a couple questions. It's really not that hard. (https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=9345 https://www.iana.org/assignments/service-names-port-numbers/...)
  - Analemma_ 10y ago
    The issue isn't the committees - as V99 said, IANA will assign you a port without too much hassle if you just ask. The real issue is stupid middleware boxes and overzealous cargo-cult-security sysadmins who block every port except 22, 80 and 443. Getting new applications with new ports to work on the real Internet is rarely worth the hassle, which is why now we have to tunnel every new protocol over HTTP.

teddyh 10y ago

> Anyway, I designed SSH to replace both telnet (port 23) and ftp (port 21). That sounds weird. Did SSH originally have file-copying capabilities? As I recall, the ssh command was written to be command-line compatible with rsh, not telnet, since rsh (and its companion rlogin) was what people were using at the time to log in over the network between local systems. The manual page for SSH still states this explicitly: “It is intended to replace rlogin and rsh […]”, and SSH from the start had (and still has) an rlogin replacement, "slogin". (Telnet was at the time only used for accessing remote, i.e. not-on-site, services, which did not necessarily imply shell access.) Anyway, the rsh and rlogin protocols use port 513 and 514, but no nearby ports seems to be unallocated. The story seems to be missing some details, or possibly be made up after the fact in lieu of a bad memory. It seemed reasonable to me at the time to give port 22 to a better replacement for, and a spiritual successor to, Telnet, but the story seems odd for not mentioning rsh or rlogin at all.

rjsw 10y ago
It still does have file-copying capabilities. See scp(1).
- teddyh 10y ago
  Scp was, according to its manual page, based on rcp (part of the rsh/rlogin set of programs): “scp is based on the rcp program”.
  - rjsw 10y ago
    Sure, but scp uses the same port as ssh so the underlying protocol has to deal with both terminal and file copying commands.
  - caf 10y ago
    Well, yes, exactly: rsh, rlogin and rcp were often considered together, as they both used the same access control - /etc/hosts.equiv. So it's not that surprising that ssh, slogin and scp came together as a replacement set.
- 10y ago

defined 10y ago

Maybe it's a subtle plug for CryptoAuditor and Universal Key Manager, products the author's company offers? > CryptoAuditor is a product that can control tunneling at a firewall or at the entry point to a group of cloud servers. It works together with Universal SSH Key Manager to gain access to host keys and is able to use them to decrypt the SSH sessions at a firewall and block unauthorized forwarding.

deleted 10y ago
[deleted]

jgrahamc 10y ago

A bigger question would be how did FTP get 21 and Telnet 23 leaving a gap for SSH?

saltcured 10y ago
Remembering how things worked bach then, someone probably invoked Catch-22...
zorked 10y ago
For some reason odd numbers are used more often than even. Ports 24, 26, 28, 30, 32, 34, 36 are all unassigned to this day.
- rwmj 10y ago
  Because of the NCP protocol which preceded TCP. It used even port numbers for outgoing data and odd port numbers for incoming data. TCP used the same port numbers, but fully duplexed the data into a single port. The well-known incoming port numbers are therefore all odd (initially, the limitation no longer applies to TCP of course). https://en.wikipedia.org/wiki/Network_Control_Program https://en.wikipedia.org/wiki/Network_Control_Program
- DonHopkins 10y ago
  That was to prevent homosocketuality. http://www.saildart.org/IMPSER.DOC[SS,SYS] http://www.saildart.org/IMPSER.DOC[SS,SYS] IGN 3 Illegal Gender (Anita Bryant feature--sockets must be heterosocketual, ie. odd to even and even to odd) The host is trying to engage us in homosocketuality. Since this is against the laws of God and ARPA, we naturally refuse to consent to it. http://www.saildart.org/FTP.NCP[S,NET] http://www.saildart.org/FTP.NCP[S,NET] gayskt: outstr [asciz/Homosocketuality is prohibited (the Anita Bryant feature)

ohlookabird 10y ago

Off topic, but maybe someone has an explanation to one thing that I wondered quite a few times on mailing lists and that I got reminded of by the E-mail Tatu Ylonen sent to Joyce K. Reynolds: Why is it that some people start their E-mail with "Dear Sir"? From where comes the (to me unreasonable) expectation that there is a single male person on the other end (instead of a mixed group)? Are there stereo-types at play or is this a language/translation thing?

deleted 10y ago
[deleted]
deleted 10y ago
[deleted]
ams6110 10y ago
Assuming you are not a native speaker since you mention language/translation, at the time it was a common salutation when one didn't know the name of the person(s) who would be reading your letter. Gender was not implied. Sometimes people would use "Dear Sir or Madam" but that's more clumsy. I was always taught in school that "he/him/his" was gender neutral if there was no context indicating otherwise. People have started to get more and more annoyed by this, leading to the grammatically incorrect usage of "them/they." Anyone who went to school or learned English in 1980s or earlier would have had learned "Dear Sir" as the standard generic salutation when writing a professional letter. I suppose today one would start such a letter with "Dear Person." That sounds somehow disrespectful to me. There's always "To whom it may concern."
- uiri 10y ago
  them/they as a gender neutral singular pronoun is not grammatically incorrect. Wikipedia has a rather extensive article on its history and usage. Criticism of this usage as incorrect only arose in the late 19th century. https://en.wikipedia.org/wiki/Singular_they https://en.wikipedia.org/wiki/Singular_they
  - ams6110 10y ago

iagooar 10y ago

I wonder if there will be a new invention like the Internet during my lifetime, where I can actually participate in shaping and defining it. While I grew up with computers, when Internet got to the first homes like mine, I was still too young and had only very limited programming skills to contribute to it. Love these stories about how simple and straight-forward it was to have a huge impact. I guess there is some nostalgia involved, but these were, in my opinion, better times.

StavrosK 10y ago
Maybe? The problem is that you can only shape it and define it when it's really small. Maybe one of the cryptocoins is it. Maybe it's Bitcoin, and you've already missed much of the boat. Who can tell? I think these things are a bit "right place right time". It has to be early enough that you can contribute, but that early and you never know if it's going to go anywhere. Any later, and the opportunity is gone.
sbov 10y ago
Mobile? Self driving cars?
300bps 10y ago
Get into VR, AI or similar fields.
lisper 10y ago
> I wonder if there will be a new invention like the Internet during my lifetime, where I can actually participate in shaping and defining it. Almost certainly there will be multiple such inventions. Internet-magnitude inventions happen once every ten years or so. The trick is that such things are generally very hard to recognize while they are still small enough for an individual to make a significant contribution. It's often hard to recognize them even when you are in the middle of them. They are often lost in a sea of very similar looking things that end up going nowhere (e.g. https://en.wikipedia.org/wiki/List_of_home_computers https://en.wikipedia.org/wiki/List_of_home_computers). Being part of Something Big is largely a matter of luck. The best you can do is to stack the odds in your favor by hanging out some place that Cool Things Happen and never stop trying new things. But many people do that for a lifetime without catching a wave.

rwmj 10y ago

A more interesting story is why are the older services using mainly odd port numbers (ie. 21 = FTP, 23 = telnet, why was port 22 free at that time?). It turns out because the protocol which preceded the invention of TCP, called NCP, used even-odd pairs of port numbers, with even for "outgoing" data and odd for "incoming". So the well-known port numbers for incoming services were all odd. Sources: https://en.wikipedia.org/wiki/Network_Control_Program https://en.wikipedia.org/wiki/Network_Control_Program http://www.pcvr.nl/tcpip/introduc.htm http://www.pcvr.nl/tcpip/introduc.htm

DonHopkins 10y ago
Back in the "bad old days" of the simplex NCP protocol [1], before the full duplex TCP/IP protocol legalized same-sex network connections, connect and listen sockets had gender defined by their parity, and all connections were required to use sockets with different parity gender (one even and the other odd -- I can't remember which was which, or if it even mattered -- they just had to be different). The act of trying to connect an even socket to another even socket, or an odd socket to another odd socket, was considered a "peculiar error" called "homosocketuality", which was strictly forbidden by internet protocols, and mandatory "heterosocketuality" was called the "Anita Bryant feature" [2]. http://www.saildart.org/IMPSER.DOC[SS,SYS] http://www.saildart.org/IMPSER.DOC[SS,SYS] When the error code is zero, the next 8 bit byte is the Stanford peculiar error code, followed by 72 bits of the ailing command returned. Here are the Stanford error codes. [...] IGN 3 Illegal Gender (Anita Bryant feature--sockets must be heterosocketual, ie. odd to even and even to odd) [...] Illegal gender in RFC, host hhh/iii, link 0 The host is trying to engage us in homosocketuality. Since this is against the laws of God and ARPA, we naturally refuse to consent to it. http://www.saildart.org/FTP.NCP[S,NET] http://www.saildart.org/FTP.NCP[S,NET] ; Try to initiate connection loginj: init log,17 sixbit /IMP/ 0 jrst noinit setzm conecb setom conecb+lsloc move ac3,hostno movem ac3,conecb+hloc setom conecb+wfloc movei ac3,40 movem ac3,conecb+bsloc move ac3,consck trnn ac3,1 jrst gayskt ; only heterosocketuals can win! movem ac3,conecb+fsloc mtape log,[ =15 byte (6) 2,24,0,7,7 ] ; Time out CLS, RFNM, RFC, and INPut [...] gayskt: outstr [asciz/Homosocketuality is prohibited (the Anita Bryant feature) /] ife rsexec,<jrst rstart;>exit 1, (The PDP-10 code above adds the connect and listen socket numbers together, which results in bit 0 being 0 if they are the same gender, then TRNN is "test bits right, no change, skip if non zero", which skips the next instruction (jrst gayskt) if they different sex.) [1] https://en.wikipedia.org/wiki/Network_Control_Program https://en.wikipedia.org/wiki/Network_Control_Program [2] https://www.youtube.com/watch?v=H-A2Ql81WTY https://www.youtube.com/watch?v=H-A2Ql81WTY

arca_vorago 10y ago

You should not be afraid to change the port number either. As a sysadmin, I have heard all the tales of no security through obscurity, which honestly I don't think is nearly as steadfast a law as people pretend, but thats another discussion. Changing ports isn't about security, it's about log fatique. Less hits on different ports, less things to stop and investigate. Even better, port knocking on non-standard port.

webwanderings 10y ago
What's better - Fail2ban or change port?
- TallGuyShort 10y ago
  Why not both? Changing the port is so trivially easy and just moves you out of the way of the majority of low-sophistication automated scans.
  - teddyh 10y ago
    (I repeat my comment from 3 years ago¹:) I think nobody argues that it adds security. The problem is that: 1. It adds very little security: 16 bits is not much, and the result is not 256 bits (say) of SSH key plus 16 bits equals 272 bits, but instead effectively still 256 bits, or 256+8×10⁻⁷³ bits. 2. The security it adds is itself bad (sent in cleartext, easily brute-forced) 3. These problems stand against the many drawbacks of this previously discussed (complexity, confusion, etc.). And the final argument: If increased security is what you want, simply increase your key lengths and/or password lengths, and you will get much more than 8×10⁻⁷³ bits of security, without any of the above problems. ① https://news.ycombinator.com/item?id=6617312 https://news.ycombinator.com/item?id=6617312
    - TallGuyShort 10y ago
      Did you reply to the right comment? Feels like you might have been addressing a different issue. There's more to security than information theory. Bits of security aside, if you're not listening on port 22 the majority of wide-scale automated scans miss you entirely. If there were some zero day being actively exploited in the wild, admins occasionally having to remember '2222' instead of '22' is pretty a pretty trivial issue and just sidesteps a lot to buy you some time to patch.

franciscop 10y ago

In my experience, if you ask nicely and have good intentions you can achieve A LOT of things that you might not expect at all.

IAmGraydon 10y ago
So true.

arielm 10y ago

Another important thing - when you want something you should ask for it. So many times I didn't ask because I _thought_ it wouldn't happen...

nepotism2016 10y ago

I was hoping for some epic Lord of the Rings story, disappointed...but SSH makes up for it :)

tremendo 10y ago
You mean like '*' the asterisk standing to mean "anything" being ASCII 42: the answer to Life, the Universe, and Everything.?

tmsldd 10y ago

If a Nobel prize equivalent existed for software developers to recognize their immense contribution to the field, Tatu Ylonen would deserve it for sure. It's great to know stories like this one.

teddyh 10y ago
The real reason for SSH being an immense contribution is that the OpenSSH fork happened when Tatu Ylönen made the original SSH program proprietary. Now that I think of it, I wish they had renamed it to something without "SSH" in the name, so he and the SSH Company couldn’t keep reaping name recognition benefits.

nathan_f77 10y ago

Wow, I had no idea that SSH had become such a huge security company [1], with 6 locations around the world. Another surprising thing is that it was only created in 1995. I was expecting it to be a few decades older. [1] https://www.ssh.com/ https://www.ssh.com/

dreamcompiler 10y ago
This is like discovering that air.com exists and is a vendor of breathable gases. (It does exist, but it appears to be a squatter domain for airline tickets.)

odbol_ 10y ago

That's pretty awful. I'm glad the industry is moving away from such discriminatory language. More recent examples of removing bias include: * Renaming master/slave to central/peripheral * Avoiding gender in code comments and documentation, e.g. "When user clicks, log him out" to "When user clicks, log them out". * Being able to disable animations globally, for epileptic users.

halomru 10y ago
How is Master/Slave discrimatory language? Who is discrimated there? In my eyes it is simply a factual description of an architecture: the master gives commands, the slave obeys. The slave doesn't act without permission from the master and only speaks when spoken to. I wish no such thing for any human, but it describes a great architecture for software and hardware.
- Tenhundfeld 10y ago
  I don't want to get into an argument about discrimination and sensitivity and trigger words and all that. The real point here is that slave has a lot of meanings, currently and throughout history, and thus has a lot of baggage. A slave is not just someone/something that obeys or only speaks when spoken to. A slave is owned by its master. A slave is entirely under the domination of the master. That doesn't really map cleanly on to replication. A master database doesn't really own or control the slave database; it just provides a log of actions performed against it that the slave needs to mimic. As I understand history, the master/slave metaphor has been used for a long time in technology (e.g., in machinery and photography), well before computers or software, but we have better terminology. Many organizations use primary/replica or even just master/replica. Using replica instead of slave seems like an obvious win. It's more precise and clear, and it avoids the baggage. It's also more intuitive when you're using the slave DB for reporting, i.e., "read replica" makes more sense to me than "read slave". Maybe that's just me. I don't see a downside to using replica.
  - antongribok 10y ago
    While following this thread I found your comment initially jarring, because in my mind I was thinking of the ATA protocol and not databases. And it appears that neither are good examples. Perhaps not the best reference, but this Wikipedia page provides some examples as well as some info on the appropriateness of use that I found interesting: https://en.wikipedia.org/wiki/Master/slave_(technology) https://en.wikipedia.org/wiki/Master/slave_(technology)

paxcoder 10y ago

You shouldn't be. We have links for this. This is plagiarism.

DonHopkins 10y ago
It's not your job to tell other people what they should and shouldn't be interested in. Is your own discomfort from being shocked that TCP/IP allows homosocketuality, because you're "not a gay supporter", so seductively connecting innocent sockets of the same parity sickens you? Certainly your morality influences how you view things. We have links for this, to plagiarize your own words: https://news.ycombinator.com/item?id=6496756 https://news.ycombinator.com/item?id=6496756 "My question is honest. My provocation is meant for the soul. I am sorry for not being kind." https://news.ycombinator.com/item?id=13246410 https://news.ycombinator.com/item?id=13246410 "Please provoke souls somewhere else." -dang
- paxcoder 10y ago
  I didn't say this shouldn't be of interest. I was defending the author of the original comment, which in light of the fact that both accounts belong to you means my intention was ensuring your attribution. I felt no discomfort here, though granted I haven't read the whole comment. "Same-sex network connections" gave me a chuckle - I assume a reference to the "male" and "female" hardware connectors. I was actually weighing on commending you for the joke before I found out the same words were used elsewhere by another account. I am surprised by the tone of your reply. I kind of hope most of my downvotes are from you then, as I would hate to see a rise in reposts. I also hope you have an automated way of finding non-positive comments, because knowing you went through them by hand would be somewhat discomforting. Now, my morality certainly should influence how I view things - that's what it's for. If it is the case that here lies your problem with me, you should be aware that when I say gay I don't have in mind the mere attraction to the same sex, but indulgence, the practice of sexual acts of this nature (which is closer to the original sexualized definition of the term). The distinction may appear subtle, but isn't really. The grave difference is between temptation and sin. In recognizing the difference, one may become accepting of the human without in process compromising that human's soul.

exabrial 10y ago

Port numbers as service locators is driving us to ipv4 exhaustion. We have 65535 port numbers available on each ipv4 address we could use to run a web server, but we only use 2 (443,80). That's 48bits of addressing information, which is a metric crap ton. I have a separate theory as to why ipv6 is being pushed so hard by advertising companies like Facebook, Google, and the US Government (CIA, NSA): it makes it very easy to casually track the number of hosts behind firewalls. While not impossible with ipv4 at the layer4 level using fingerprinting techniques, it's quite difficult to do at scale, is unreliable, and spoofable. Ipv6 makes this trivial for anyone, and will allow ip transit providers to scrape more information about users, even those encrypting layer5+ traffic.

Hello71 10y ago
privacy extensions
- exabrial 10y ago
  I'm familiar with them, while they allow one to hide your MAC address, they still individually identify you. It's sort of how like Verizon was caught injecting an arbitrary, but unique, http header into their user's http traffic. While it didn't provide your actual identity, it allowed advertisers to sort your traffic very easily.
tjoff 10y ago
Is there any reason not to do NAT with ipv6 for the casual user?

killin_dan 10y ago

So there's actually not a story? I read the email and the dude just gives them that port assignment with no ceremony. I was hoping it would be more climactic. HN doesn't really seem concerned that all these titles are low-quality bait. Guess they're digging those page req numbers. Unfortunate how effective it is to just deceive your users.

emmelaich 10y ago

In a way it's pity it was so easy. /etc/services is now testament to a multitude of broken dreams.

hwestiii 10y ago

tl;dr - I asked for it. - They gave it to me.

gejjaxxita 10y ago

I am aged thirty and every day I use a technology that didn't exist when I was eight, furthermore this technology "feels" ancient to me. It's a bit cliche but the pace of innovation in our field (at least up to now), and the rate at which we get used to new things, is amazing.