3 ms·
Actually, this works for a practical reason: scanning ports takes time and resources, and script kiddies are more likely to move on to the next target if they d
by swombat 16y ago
Actually, this works for a practical reason: scanning ports takes time and resources, and script kiddies are more likely to move on to the next target if they don't find a worthwhile target in the first few thousand ports. It won't help against a determined attacker, of course, but it does reduce the number of less-skilled attacks.
- thaumaturgy 16y agoPeople keep mentioning this, and I really don't understand why. Do you have a username/password or username+certificate that a script kiddy is likely to hit in their first 10,000 attempts? If yes, you have a much larger problem that can't be solved by port knocking or moving ssh to a different port. If not, then you're trying to solve a problem which doesn't exist anyway.
- swombat 16y agoIf there is a 0-day or unreleased SSH vulnerability, your login security doesn't matter. In those cases, it helps if the s'kiddies skipped your site altogether because they couldn't be bothered to wait to find where your ssh port is.
- thaumaturgy 16y agoAh, thanks. That's a big if, but it has happened, so it makes some sense.