3 ms·
My advice, and I've been doing security for about 10 years now, run SSH on the normal SSH ports. Keep it patched. Install a good password policy. Centrali
by TheCondor 16y ago
My advice, and I've been doing security for about 10 years now, run SSH on the normal SSH ports. Keep it patched. Install a good password policy. Centralize your accounts in an LDAP database. And then, perhaps restrict the SSH access to the few accounts or users that really need it. Perhaps you could use a jump host..
The obscurity approach doesn't actually increase security, it does increase the difficulty to use and diagnose things (it's just another step to remember and your network is just a little bit different form everybody else') and it might give you some artificial sense of being more secure. Plus there are off the shelf tools that can monitor and even dynamically repair those attacks on the fly (IPS products) and when you start using different ports those tools don't all work the same way and some won't work at all, in that case the obscurity would actually reduce your security and reduce the effectiveness of other tools you use for security.
- danielrm26 16y agoThe military disagrees, that's why they paint their tanks to match their surroundings. If you're saying that you could get confused and the hassle is worth more than the gain, that's one thing, but to say that there's no benefit is false.
- artmageddon 16y agoQuite honestly at worst you'll just keep out clueless script kiddies, but a determined person can still find your SSH port. It's also worth noting that your server isn't going to launch a 105mm depleted-uranium tank shell in the face of some unscrupulous port-scanner :)
- njharman 16y agoNumber of clueless script kiddies far, far, far outweigh number of determined people after my particular server. Reducing risk of actual threats == security. Dogma, let it go.
- danielrm26 16y agoPrecisely correct.
- artmageddon 16y agoFair enough regarding making the port harder to find, but I hope it's not your only countermeasure.
- TheCondor 16y agoI don't know that I'd equate camouflaging a tank to switching ports. nmap and other tools will already identify services on different ports, switching ports protects you from the dumbest of the dumb robots and that's it. The cost of which is potentially more confusion on your network. The other cost if you have an IPS that is protocol aware, it may not work with your altered ports. I guess if you're only worried about script kiddies and robots then there is potentially some benefit. If you're worried about actually being attacked then it makes your life marginally more difficult (just a tiny bit more complexity) and it offers no security.
- jarek 16y ago> nmap and other tools will already identify services on different ports Yeah, and camouflaged tanks show up pretty plain in infrared.