3 ms·

I've got the SSH port on my webserver set to a random >1024 port, and I get at least 2-3 denyhosts emails per day.

• dspillett 16y ago
  You should not run a system service on a port below 1024. On unix-a-like systems there is usually a rule that a non privileged user can not listen on a port below 1024 - Apache and similar services do it by running as root or similar initially and dropping privileges once the port is open and ready. If you run SSHd on a port over 1024 you increase the chance that an non-privileged user on your machine (a user on a shared host, or a compromised externally accessible application) might somehow crash your SSHd and launch its own to capture usernames/passwords or such. Bots scanning for SSH on ports other than 22 will likely scan the whole 65536 range, not just the first 1024, so you don't get extra obscurity by using a higher port.
  • gnosis 16y ago
    "Bots scanning for SSH on ports other than 22 will likely scan the whole 65536 range, not just the first 1024, so you don't get extra obscurity by using a higher port." Do you have any statistics to back up that assertion? I'd expect most attackers to concentrate on ports below 1024, with proportionately fewer of them bothering to scan higher ports.