4 ms·

What is the problem?

• nitrogen 9y ago
  Another authorized user or a non-root RCE compromise could start listening on the ssh port if sshd ever dies for some reason.
  • gsich 9y ago
    And then what? /etc/ssh is still owned by root, another user can't see the hostkeys. So you'll get an error message if custom keys are used.
    • dredmorbius 9y ago
      Remote user tries to log in. Cannot. Issues (or trojan prompts for) password. It's a game of percentages.
      • gsich 9y ago
        SSH key verification...
        • dredmorbius 9y ago
          Server key? Sure, but what's the accept rate on new keys? On short-lived, poorly provisioned, AWS instaances, as just one example. Again, percentages. With enough attempts, some will succeed.
          • gsich 9y ago
            If it's a new server (like your example) there should be no other user already logged in. If it's not new, then you'll get a warning. And focusing on the "shortlived", so the damage is also shortlived... I can only speak for myself, if other people are ignoring warnings, it's their problem.
            • dredmorbius 9y ago
              The original question was: what's the risk, or threat model. I believe that's been adequately addressed.
              • nitrogen 9y ago
                The other question is whether other risks are greater; if a high port number is your only choice, or handled by port forwarding on a router, or you are the only user, or high numbers are scanned sufficiently less often, then maybe you still choose one.
                • dredmorbius 9y ago
                  Quite. Though, as you note, another question. Restricting the remote IP range is another option.