11 ms·
How SSH port became 22
- degenerate 8y agotl;dr - port 22 is between 21 (FTP) and 23 (telnet) and Tatu thought it would give the service clout to have 22. IANA approved his email request and it was registered.
- Jaruzel 8y agoThe body text of the article is only 1273 words. It takes all of a minute to read it. At which point did the bar for tl:dr become so low?
- dotancohen 8y agoWhen clicking a link to discover just how short an article it is became the norm. So, I'd guess somewhere around the Chips & Dips era.
- foodstances 8y agoWhen it started to take 1273 words to say one sentence of information to attract readers.
- JoshTriplett 8y agoWhile the copies of the original emails are mildly interesting, it looks like the answer is just "Because I asked for port 22 and got it".
- ahnick 8y agoIMHO the interesting thing about the emails is it provides insight into his process of asking for it. He had done all of the other work ahead of time and even provided the draft protocol spec in his email. He also was willing to accept a different port number assignment, but gently suggested just continuing what they had been using during local testing. Had he asked in a very terse manner or not done as much legwork up front, then conceivably he might not have received a port assignment at all.
- notyourwork 8y agoThese personas are the biggest difference I find between great and decent engineers. Great engineers do their homework or due diligence first.
- isostatic 8y agoAnd that's what's amazing, and shows what a different time the internet was in the 90s.
- some_account 8y agoI want that time back in a way. Before the internet turned into entertainment for the masses because companies wanted to make money.
- makapuf 8y agoand it can definitely be ! You can carve your own small internet corner just like before. Just find your niche on the internet, and keep on doing what you want. You won't have mass funding, hundreds of free servers and fame / millions of followers, but that's what expected. A few guys/pals doing what they love on the net. You can even post a few videos and have a small forum now !
- BLKNSLVR 8y agoLove your comment, and that's part of the magic of the Internet being "open"; anyone can create their little slice of it, and for free if they're happy to start out small. Quality content generates its own organic growth, and organic growth is generally much more sustainable than forced / purchased / out-of-context-marketed growth. If you need to make money from it, you're doing 'old-sk00l internet' wrong.
- makapuf 8y agoThanks you're right, except you can just pay a small fee (typically a coffee per month) and be fully autonomous and have no growth but just enjoying your small community. (I meant gals not pals in the preceding comment)
- isostatic 8y agoWe had small forums and post a few videos 20 years ago Many people today seem to think that the only way to build a website is to build something that will dynamically scale to 100 million users and remain online even in the case of nuclear war.
- deleted 8y ago[deleted]
- Bluestrike2 8y agoWhich is pretty neat in its own right. It's easy to romanticize those days (which no doubt had plenty of their own problems), but something like this seems to say a bit about how the early web came to be. It's hard to think of something as fundamental nowadays as ssh as just some new program making its way onto mailing lists with its author (Tatu Ylonen) probably wondering whether it would go anywhere.
- brlewis 8y agoInternet, not web. This was a time when nobody used those terms interchangeably.
- nineteen999 8y agoPerhaps amongst the technical crowd. I clearly remember the average dial up user at that time was excited about "surfing the net".
- foodstances 8y agoBecause they did use more than the web. Usenet, e-mail, FTP, etc.
- nineteen999 8y agoYes and as another responder pointed out Gopher as well. Perhaps that's my bias I think that was still mainly the techy crowd. Most of the non-technical people I helped get connected in those days were only interested in how to find the Netscape browser icon. With Eudora email and later Outlook Express as a close second. They certainly didn't really differentiate the Internet from the Web. Perhaps that was just my limited experience here in Australia.
- u801e 8y agoMost people I knew called it being online or on the internet in the mid to late '90s. A lot of people I knew used applications like Free Agent and mIRC and a certain GUI FTP client (which I can't remember the name of).
- cup-of-tea 8y agoSo why did FTP have 21 and telnet have 23?
- Macha 8y agoThe convention early on was apparently to have odd destination ports and even source ports, compared to using random high port numbers for source ports nowadays. As such, when the earliest protocols were being developed, they weren't giving out odd port numbers, but by the time ssh requested it they were. https://www.quora.com/Why-does-Telnet-use-port-23 https://www.quora.com/Why-does-Telnet-use-port-23
- isostatic 8y agoFTP has port 21 and port 20.
- js2 8y agoFTP's use of two ports is unusual. Port 21 is used for the control channel and port 20 for data transfer. Its original design goes back to 1971 and predated TCP/IP by quite a bit. In the original design ("passive" mode wasn't added till later), the client connects to a server on port 21 and then when it wants to transfer a file, opens a local port and the server connects back to the client from port 20. Also, FTP supported server-to-server transfers, where the client connected to a pair of servers and then initiated a transfer between them[0]. [0] https://tools.ietf.org/html/rfc765 https://tools.ietf.org/html/rfc765 Figure 2.
- nailer 8y ago> The number should preferably be in the range 1-255 so that it can be used in the WKS field in name servers. Can't find any reference to WKS as a 'field' or record type. Any greybeards want to elaborate?
- strong_silent_t 8y agoBy name servers they mean DNS. I don't believe it is used and I hadn't heard of it, more info here if you search WKS: https://en.wikipedia.org/wiki/List_of_DNS_record_types https://en.wikipedia.org/wiki/List_of_DNS_record_types
- nailer 8y ago> By name servers they mean DNS. Yeah I know. Hence mentioning record types in the question you're reponding to. But yes, that wikipedia page has some info: > WKS: Record to describe well-known services supported by a host. Not used in practice. The current recommendation and practice is to determine whether a service is supported on an IP address by trying to connect to it. SMTP is even prohibited from using WKS records in MX processing.[12]
- neilwilson 8y agoGood old RFC 1035 is your friend Section 3.4.2
- jwilk 8y agohttps://tools.ietf.org/html/rfc1035#section-3.4.2 https://tools.ietf.org/html/rfc1035#section-3.4.2
- amelius 8y agoWhy is it still port "22" and not port "ssh"? It seems a bit silly to be using numbers in this day and age.
- ebbv 8y agoWell, first off, you probably should change your SSH port. Using a non-default one will cause most automated attacks to move on to something else. Second, using numbers is far more memory/bandwidth efficient than using strings for ports. Last, there's no good reason to make the massive effort it would take to change it to strings.
- paulie_a 8y agoI would love to to know what success rate those idiotic ssh scanners have. They seem to be braindead in their approach.
- ed312 8y agoLike email scammers they're attacking the lowest hanging fruit - people who don't know better and/or have no other option.
- atm0sphere 8y agoI bet the hit rate is some non-zero positive integer.
- ars 8y agoAs an experiment I put up an in-memory server at a random IP, with a root password that was in the dictionary. It was infected within an hour, and by multiple attackers. It also reminds me about how there was a time when it was impossible to install XP - you needed internet access to get the latest patches, but by the time you downloaded them you were already infected. So yes, they do work.
- throwvondannen 8y agoWinning the lottery becomes feasible when you fill your tickets out by the truckload. It's quite doable to hit everything with your dictionary and sure enough you'll catch a bunch of boxes with laughable passwords in your dragnet. These days it's mostly random IoT devices that come with preconfigured ssh service and known passwords. More interesting might be the fact that there's a strong chance that any successfully hit host is already compromised because you're just one of a myriad people doing this exact thing. In a way it's comparable to overfishing. edit: If you run a honeypot/net you can watch those scripts poking around to check if a competitor has already left his mark and will then try to remove his access. There's a fast paced arms race going on in that regard.
- rynop 8y agoNice read. Helped me take a moment to reflect how wonderful of a tool ssh is. Simple to use, yet powerful. Thanks Tatu!!
- 0x0 8y agoThe article only briefly mentions port >= 1024 for non-root, but it's probably important to note that it is desirable to have the default port be < 1024. That way, you can be sure you are connecting to an sshd operated by the remote system's root user (and not, say, a random student's unix user account running a spoof sshd). Obviously this matters more for multi-user systems, but even today it's nice to know that the sshd listen port on the remote end can't be hijacked by a random wordpress exploit kit (unless that kit also privesc's to root)
- wyldfire 8y agoThe port number shouldn't be used to give you information regarding a host's reputation. You should use fingerprints on initial connection and rely on the host keys for subsequent ones.
- mmirate 8y agoBubkes. A middlebox can transparently rewrite incoming packets' port numbers from 22 to 2200, and backwards.
- 0x0 8y agoAbsolutely. But in a classic UNIX network, middleboxes aren't a part of the threat model. Unprivileged UNIX user accounts binding on TCP ports were and are. So, ports below 1024 were reserved for the root account and that was a decent protection at the time against enterprising users trying to race system daemons in binding listening sockets. See for example https://www.w3.org/Daemon/User/Installation/PrivilegedPorts.html https://www.w3.org/Daemon/User/Installation/PrivilegedPorts.... And even today, it still protects against an exploit kit running as "www-data" or "nobody" springboarded from a wordpress exploit.
- UncleEntity 8y agoI thought you had to explicitly tell ssh to connect on a different port than 22 with the -p option which would prevent you from connecting to a spoof sshd. I've only used it recently to get around McDonald's (apparent) throttling on port 22, moved sshd over to 443 and can saturate the wifi.
- amichal 8y agoAround this time the method to get a DNS name was basically the same. Send an email with some reasoning to the right person and the name was yours. I remember being amazed that was the case. I also got a SSL cert issued around 1995-6 and the process then was email followed by faxing (or paper mail) proof (in the form of bank account, DUNS numbers and state-level incorporation records) documentation confirming you were who you say you were. I dont believe money even changed hands then.
- schoen 8y ago> I dont believe money even changed hands then. Do you know which CA this was? Maybe you got in during some kind of test or audit period, before the CA had begun its regular business operations?
- amichal 8y agoI dont know for certain. I'm almost certain it was Verisign. They might not have been using that name yet. There was a bunch of phoning around to see how this was even done. Asking Wikipedia isn't helping me much just confirms that all this was new back then. I also didn't handle the money for us so it's possible we where invoiced or someone sent a check that I didn't know about. I dont even remember why we felt we needed it at the time.
- schoen 8y agoI'm sure it must have started off with a period of time where things were pretty informal and touch-and-go!
- raarts 8y agoI vividly recall getting a visit (around '96) from Mark Shuttleworth (of Canonical fame). He had founded Thawte Consulting, I think the first competitor of Verisign, who were the only company that sold SSL certificates at the time. He was traveling Europe to visit ISPs trying to woo them into using his service for SSL certificates. He had to spend some time explaining what certificates actually are, because I only had a vague idea (I founded one of the first ISPs in the Netherlands but nobody used SSL at the time). He was much cheaper than Verisign, by automating the process on his site so it was an easy sell.
- moogly 8y agoPrevious discussion (with some of the same comments): https://news.ycombinator.com/item?id=14178091 https://news.ycombinator.com/item?id=14178091
- exabrial 8y agoIt became port 22 because we don't use srv records and we wonder why we have an IPv4 crisis when there's like only 3 ports of 64k used on any server: 443,80,22.
- chungy 8y agoIPv4 crisis has pretty much nothing to do with ports.
- pixl97 8y agoEh, with srv records and port forwarding one IP can easily serve 20,000+sites.
- chungy 8y agoIt's hardly in dispute but it doesn't really detract from how limited IPv4 addressing is. There's only about 3.7 billion addresses available for the entire world. This is in contrast to IPv6, where in the worst case, each organization would have a /64 and the entire world would have approximately a quintilian networks (2^(64-4), subtracting the /4 that the entire Internet is currently restricted to), each of which can support 18 quintilian hosts.. And that's worst case, even residential ISPs frequently give out /56s.
- exabrial 8y agoCommon core math strikes again
- wahern 8y agoSSH is largely an administrative service. The box may not have an assigned domain name, may have an ephemeral address, or otherwise not be tied into DNS. Also, RFC 2052 was published in late 1996. RFC 2782, which defined SRV as we know it today, was published in 2000. Port 22 was allocated in early 1995.
- kimdotcom 8y agoI always thought it was because it was one less than telnet's port 23.
- NoPicklez 8y agoThat sounds like an interesting way to remember it, but isn't necessarily the reason why.
- rustcharm 8y agoI've run it on port 443 (https port) which makes it possible for me to get through to it from inside many corporate firewalls.