4 ms·
I typically just pick a high numbered port. > 10k would work. I see it as a way to reduce the number of attacks, which is helpful, and may end up being more se
by xur17 9y ago
I typically just pick a high numbered port. > 10k would work.
I see it as a way to reduce the number of attacks, which is helpful, and may end up being more secure, but I wouldn't count on that alone. Against botnet attacks it will likely help, but against someone specifically targeting you, it likely will only slow them down.
Basically it boils down to 'why not?' for me.
- munin 9y agoA high numbered port (above 1024) can be bound by non root programs. Use some non 22 port below 1024 if you want to change the port. Or use some RBAC system like selinux to keep anyone from binding to 2222 or whatever.
- gsich 9y agoWhat is the problem?
- nitrogen 9y agoAnother authorized user or a non-root RCE compromise could start listening on the ssh port if sshd ever dies for some reason.
- gsich 9y agoAnd then what? /etc/ssh is still owned by root, another user can't see the hostkeys. So you'll get an error message if custom keys are used.
- dredmorbius 9y agoRemote user tries to log in. Cannot. Issues (or trojan prompts for) password. It's a game of percentages.
- gsich 9y agoSSH key verification...
- dredmorbius 9y agoServer key? Sure, but what's the accept rate on new keys? On short-lived, poorly provisioned, AWS instaances, as just one example. Again, percentages. With enough attempts, some will succeed.
- gsich 9y agoIf it's a new server (like your example) there should be no other user already logged in. If it's not new, then you'll get a warning. And focusing on the "shortlived", so the damage is also shortlived... I can only speak for myself, if other people are ignoring warnings, it's their problem.
- dredmorbius 9y agoThe original question was: what's the risk, or threat model. I believe that's been adequately addressed.
- nitrogen 9y agoThe other question is whether other risks are greater; if a high port number is your only choice, or handled by port forwarding on a router, or you are the only user, or high numbers are scanned sufficiently less often, then maybe you still choose one.
- dredmorbius 9y agoQuite. Though, as you note, another question. Restricting the remote IP range is another option.
- gregmac 9y agoAwesome point, and exactly the advice I was looking for.