3 ms·
This is a failed study. He should have removed "Port 22" from the config file to get any significant results. Right now it only says that if an attacker gets a
by relix 16y ago
This is a failed study.
He should have removed "Port 22" from the config file to get any significant results. Right now it only says that if an attacker gets an SSH-like answer on port 22, it's very unlikely he'll try on port 24 as well.
This is unhelpful because if there's a bug in OpenSSH, then even an OpenSSH "reject all on port 22" configuration* might be compromised.
I think it's very much more likely that an attacker, when not getting any answer (or being instantly rejected) on port 22, will portscan the server to see if any other ports are open, and then try the non-standard port, which in this case is 24.
* I'm unsure if this is possible in SSH (like reject all root logins), but anything non-standard might trigger the "no SSH @ 22" response, so I'm hypothesizing a best-case-scenario config.
- danielrm26 16y agoYou're assuming a human attacker, which is not the case for the vast majority of probes and attacks. Bad guys don't generally sit there with a port scanner going from IP to IP. This is all scripted stuff we're talking about.
- teaspoon 16y agoScripts can't implement conditional behavior?
- danielrm26 16y agoIt's not a matter of "can't"; it's a matter of "don't". My understanding is that scripts check a few places and move on. They're not AI-scripted human replacements that start scanning the entire Internet on all ports once they get an RST or a drop on 22.