5 ms·
Better to have it listening on a port below 1024, otherwise a non-root user could impersonate the ssh daemon.
by noja 8y ago
Better to have it listening on a port below 1024, otherwise a non-root user could impersonate the ssh daemon.
- noir_lord 8y agoI agree except if a non-root user I don't know about is binding to any ports from inside then I'm already hosed.
- noja 8y agoA non-root user might not be a person, it might be a compromised php script.
- noir_lord 8y agoTrue but if my system has a compromised anything binding to a port then they can talk to it via whatever they want at that point. I'm of the opinion that if an attacker gets a local account then I'm already hosed given the regularity of local privilege escalation CVE's
- deathanatos 8y agoThis would be detected by SSH, as the host key wouldn't match. (The impersonator wouldn't be able to use the same host key, as they would need the private key, and that requires root privs.)
- noja 8y agoA lot of people who don't care much for checking keys.