3 ms·

As a total Linux n00b, I was given the advice to also run SSH on a non-standard port 4 digit port like 4232 instead of 22. I don't know how effective that is, b

As a total Linux n00b, I was given the advice to also run SSH on a non-standard port 4 digit port like 4232 instead of 22. I don't know how effective that is, but it sounded like good advice to me.

iuguy 16y ago
Running SSH on a different port sounds like good advice because the automated scanning tools tend to focus on port 22. However, if you're vulnerable to the scanners then you haven't actually addressed the vulnerability they exploit. What you're looking at is a form of security by obscurity that reduces the number of low end attacks, but if someone port scans you, finds the SSH port and runs the same attacks you're still going to get compromised. Another thing to consider is that if you're moving SSH ports your OS will still respond to requests to connect over SSH by telling the scanners that there's no SSH service running on that port. If you're being metered for bandwidth by bytes transferred it shouldn't be a lot (unless you're getting really hammered by it, which tends to happen when the IP address has been previously compromised). The correct way to deal with this is to use only public key authentication (which stops people getting in through password brute forcing) and to block the port with a firewall with exceptions for the places that you access it from. You can find out where you're accessing it from by going through the SSH logs. By all means swap ports if you want to, but don't rely on it alone.
wazoox 16y ago
That doesn't dispense from using the advices in this article, which is a basic description of my setup. Look at my home PC logs : $ sudo grep sshd /var/log/messages* | wc -l 23084 Of course I connect several times a day, however you see the sheer number of scans, the oldest message log is less than one month old.

3 ms·

As a total Linux n00b, I was given the advice to also run SSH on a non-standard port 4 digit port like 4232 instead of 22. I don't know how effective that is, b

by hkarthik 16y ago

As a total Linux n00b, I was given the advice to also run SSH on a non-standard port 4 digit port like 4232 instead of 22. I don't know how effective that is, but it sounded like good advice to me.

iuguy 16y ago
Running SSH on a different port sounds like good advice because the automated scanning tools tend to focus on port 22. However, if you're vulnerable to the scanners then you haven't actually addressed the vulnerability they exploit. What you're looking at is a form of security by obscurity that reduces the number of low end attacks, but if someone port scans you, finds the SSH port and runs the same attacks you're still going to get compromised. Another thing to consider is that if you're moving SSH ports your OS will still respond to requests to connect over SSH by telling the scanners that there's no SSH service running on that port. If you're being metered for bandwidth by bytes transferred it shouldn't be a lot (unless you're getting really hammered by it, which tends to happen when the IP address has been previously compromised). The correct way to deal with this is to use only public key authentication (which stops people getting in through password brute forcing) and to block the port with a firewall with exceptions for the places that you access it from. You can find out where you're accessing it from by going through the SSH logs. By all means swap ports if you want to, but don't rely on it alone.
wazoox 16y ago
That doesn't dispense from using the advices in this article, which is a basic description of my setup. Look at my home PC logs : $ sudo grep sshd /var/log/messages* | wc -l 23084 Of course I connect several times a day, however you see the sheer number of scans, the oldest message log is less than one month old.