4 ms·
Glad you mentioned choosing a obscure port. Not that 24 is wrong though <1024 are reserved for various protocols so usually I tend to select ports above this r
by notyourwork 16y ago
Glad you mentioned choosing a obscure port. Not that 24 is wrong though <1024 are reserved for various protocols so usually I tend to select ports above this reserved range. Never know when you decide to roll out say mail on 25 and sure enough find out your ssh port is running on 25.
- kijinbear 16y agoAny port not listed in the link below, or listed as "Unassigned", would be fair game. http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_number...
- LordLandon 16y agoIf you're running a multi-user server, with possibly malicious users, that's not a good idea. Ports <1024 can only be bound to by root; so if a valid user of the server can figure out how to crash sshd, he can run his own version on the same port >1024, and then all your users' password are belong to him.
- petercooper 16y agoWhen I read your comment, I thought "surely you couldn't rig up a fake sshd to steal passwords" thinking the protocol wouldn't send passwords in plaintext but instead some hashing would take place. I read the RFC and, wow, it does send plaintext (though it's over an encrypted transport). Ouch..
- ryanpetrich 16y agoAny client that has the server's public key in their known_hosts will throw up a big fat error.
- jluxenberg 16y agoThis is mitigated by not allowing password-based logins for SSH. Your point still stands though.