3 ms·

You're looking at this the wrong way, because you seem to assume that non-standard ports adds to security the same way the key length does, which is not the cas

You're looking at this the wrong way, because you seem to assume that non-standard ports adds to security the same way the key length does, which is not the case.

teddyh 9y ago
I can’t think of any way it could be otherwise, but please, feel free to enlighten us all how a non-standard port number adds any more security than would an additional 16-bit key.
- gsich 9y ago
  There is no added security. Just added comfort of not having to deal with spammers filling up logs.
- dredmorbius 9y ago
  Vastly fewer attacks -> less cognitive load on admins. The logs don't fill up. Technical protection is likely limited, but then, admin attention is also a limited resource.
  - enjoy-your-stay 9y ago
    Also means attackers are much easier to spot in the logs. It's also a point of real interest if an attacker took the time to port scan you first in order to detect which port your ssh is on.
    - dredmorbius 9y ago
      Or, if you prefer, you're choosing to associate with a higher grade of adversary.
- blattimwind 9y ago
  Non-standard ports, port knocking and similar things work before anything reaches sshd; so they can mitigate vulnerabilities in sshd. Obviously a non-standard port is the weakest fellow in the bunch, but that does not mean the effect is zero. An extra 16 bit key length would obviously never mitigate a sshd vulnerability. An entirely different effect has been brought up by others already; a non-standard port is enough to evade ~99 % of all automated attacks, therefore you can run at higher log levels and might notice actual attackers earlier.
  - teddyh 9y ago
    > Obviously a non-standard port is the weakest fellow in the bunch, but that does not mean the effect is zero. Like I said, nobody argues that it adds zero security, but that, for all the hassle it introduces, it adds way too little security to be worth it. 16 bits is nothing, and can be brute forced quickly. Regarding port knocking: I’m assuming that most people don’t write their own port knocking software, but use something standard. The configuration of any port knocking scheme is equivalent to an additional separate key of length log2(number_of_possible_port_knocking_configurations). What is the effective “key length” of port knocking schemes? Also remember that the “key” of port knocking, just like a non-standard port number, is transmitted in the clear, so anybody listening to the traffic can see it. (And if you assume that the attacker can’t listen to the traffic, why are you even using SSH instead of something simpler like telnet?)

You're looking at this the wrong way, because you seem to assume that non-standard ports adds to security the same way the key length does, which is not the case.

teddyh 9y ago

I can’t think of any way it could be otherwise, but please, feel free to enlighten us all how a non-standard port number adds any more security than would an additional 16-bit key.

gsich 9y ago
There is no added security. Just added comfort of not having to deal with spammers filling up logs.
dredmorbius 9y ago
Vastly fewer attacks -> less cognitive load on admins. The logs don't fill up. Technical protection is likely limited, but then, admin attention is also a limited resource.
- enjoy-your-stay 9y ago
  Also means attackers are much easier to spot in the logs. It's also a point of real interest if an attacker took the time to port scan you first in order to detect which port your ssh is on.
  - dredmorbius 9y ago
    Or, if you prefer, you're choosing to associate with a higher grade of adversary.
blattimwind 9y ago
Non-standard ports, port knocking and similar things work before anything reaches sshd; so they can mitigate vulnerabilities in sshd. Obviously a non-standard port is the weakest fellow in the bunch, but that does not mean the effect is zero. An extra 16 bit key length would obviously never mitigate a sshd vulnerability. An entirely different effect has been brought up by others already; a non-standard port is enough to evade ~99 % of all automated attacks, therefore you can run at higher log levels and might notice actual attackers earlier.
- teddyh 9y ago
  > Obviously a non-standard port is the weakest fellow in the bunch, but that does not mean the effect is zero. Like I said, nobody argues that it adds zero security, but that, for all the hassle it introduces, it adds way too little security to be worth it. 16 bits is nothing, and can be brute forced quickly. Regarding port knocking: I’m assuming that most people don’t write their own port knocking software, but use something standard. The configuration of any port knocking scheme is equivalent to an additional separate key of length log2(number_of_possible_port_knocking_configurations). What is the effective “key length” of port knocking schemes? Also remember that the “key” of port knocking, just like a non-standard port number, is transmitted in the clear, so anybody listening to the traffic can see it. (And if you assume that the attacker can’t listen to the traffic, why are you even using SSH instead of something simpler like telnet?)