4 ms·

As an aside; is there a reason to host SSH on a non-standard port? I recently came across a system that had it listening to a really high port number. I dismi

As an aside; is there a reason to host SSH on a non-standard port? I recently came across a system that had it listening to a really high port number. I dismissed it as security through (bad) obscurity but is there a valid security reason to do this? EDIT: Thanks to everyone who answered my question! It makes sense to me now why one might do this.

0x0 7y ago
It reduces the amount of endless bruteforce attempts somewhat, so log files are slightly more readable. Although recently this seems to be significantly less effective compared to the previous 20 years...
joombaga 7y ago
If it's exposed to the internet, definitely. Port 22 gets hammered.
- wazoox 7y ago
  Indeed. In fact it's hammered so bad that it made my home machine crawl at times. By changing ports it went from several thousands attempts per hour to a few per day.
_-___________-_ 7y ago
The author didn't say it had anything to do with security. I have one or two SSH daemons out there listening on non-standard ports because of stupid limitations of middleboxes I'm forced to use, or because they're port-forwarded through something that already listens on 22 itself. Security-wise, it seems pointless; my daemons on random non-standard ports still get hammered, and fail2ban takes care of keeping the log spam down just as easily as it does the ones on 22.
deleted 7y ago
[deleted]
spzb 7y ago
It massively reduces the number of script kiddie attacks. It's not hard to find SSH on a non-standard port but most SKs don't know or don't bother. Other possible reason is NAT. If you've got several machines or VMs but only one public IP you can port forward different public ports to port 22 on different machines. Not the only solution by a long way but a relatively straightforward one.
jerf 7y ago
Security-through-obscurity isn't a bad thing. It's just bad to overestimate what it can do, or for it to be your only security. I have my publicly-accessible SSH port on not-22, just to avoid the log messages from scanners. I'm well aware it does not, on its own, actually "secure" anything, but it brings more convenience to me for it to be a bit obscure, and it certainly isn't hurting anything.
pwg 7y ago
Valid reason: Testing something that uses ssh, but the test host already has a sshd running on port 22, and one does not want to disrupt that setup for the test. Or running tests as a local, non admin, user and one does not want to bother the admin with modifying the system sshd setup for those tests. Other reasons: Those doing it /instead/ of running on port 22 are usually doing it for one of at least two reasons: 1) a false sense of security. If you do an internet search, you'll find plenty of blog posts boasting that using an alternate port is a security feature (it is not, it is security via obscurity); or 2) to reduce the log growth from all the script kiddie scans that target port 22 (note, no security is added here, but one's log files don't grow quite as rapidly either).
clarry 7y ago
Significantly less log spam.
nucleardog 7y ago
Slighty reduces your risk from all the automated spam. Most things that are scanning the entire internet trying to brute force weak passwords and stuff aren't trying 65,000 ports on each host. Any sort of worm/botnet will probably be in the same situation. The only hosts we have with any SSH exposed to the world at all are a couple of bastion hosts. Day-to-day we access everything else through a VPN, so its only exposed at all as an emergency backup in case the VPN breaks. Really no inconvenience to having it moved to a high port.
h4waii 7y ago
IMHO, this isn't "security through obscurity" but it's a way of weeding out automated attacks and reducing logs filling up with completely avoidable entries. I'd say it has valid "sysadmin" reasons but not "security" ones. Given 2 boxes with the exact same SSH setup (key auth, fail2ban, or whatever else you use) I'd prefer to admin the one with a non-standard port solely for the fact that it's not undergoing constant attack which uses resources (albeit tiny).
matthew-hollick 7y ago
There are pros and cons. It does mean that you should get less ssh bot spam but it also means that you run ssh on a non privileged port - one that a malicious application running as non-root might attempt to exploit.
carlisle_ 7y ago
There's actually a good reason to not use SSH on a non-privileged port: It allows an unprivileged user to bind their own binary to the port when SSH restarts or otherwise stops listening.
- nickodell 7y ago
  That unprivileged user will not have the SSH host key, which will create a warning for any user who connects, just as though someone had conducted a man-in-the-middle attack. Of course, there are plenty of privileged ports to choose from. https://www.google.com/search?q=random+number+between+1+and+1023 https://www.google.com/search?q=random+number+between+1+and+...
__s 7y ago
I use Chrome SSH to ssh into my WSL2 debian instance on Windows 10. Native terminals don't support mouse events. But port 22 can already be in use by the host system, so I have WSL2 configured to listen on port 222

0x0 7y ago

It reduces the amount of endless bruteforce attempts somewhat, so log files are slightly more readable. Although recently this seems to be significantly less effective compared to the previous 20 years...

joombaga 7y ago

If it's exposed to the internet, definitely. Port 22 gets hammered.

wazoox 7y ago
Indeed. In fact it's hammered so bad that it made my home machine crawl at times. By changing ports it went from several thousands attempts per hour to a few per day.

_-___________-_ 7y ago

The author didn't say it had anything to do with security. I have one or two SSH daemons out there listening on non-standard ports because of stupid limitations of middleboxes I'm forced to use, or because they're port-forwarded through something that already listens on 22 itself. Security-wise, it seems pointless; my daemons on random non-standard ports still get hammered, and fail2ban takes care of keeping the log spam down just as easily as it does the ones on 22.

deleted 7y ago

[deleted]

spzb 7y ago

It massively reduces the number of script kiddie attacks. It's not hard to find SSH on a non-standard port but most SKs don't know or don't bother. Other possible reason is NAT. If you've got several machines or VMs but only one public IP you can port forward different public ports to port 22 on different machines. Not the only solution by a long way but a relatively straightforward one.

jerf 7y ago

Security-through-obscurity isn't a bad thing. It's just bad to overestimate what it can do, or for it to be your only security. I have my publicly-accessible SSH port on not-22, just to avoid the log messages from scanners. I'm well aware it does not, on its own, actually "secure" anything, but it brings more convenience to me for it to be a bit obscure, and it certainly isn't hurting anything.

pwg 7y ago

Valid reason: Testing something that uses ssh, but the test host already has a sshd running on port 22, and one does not want to disrupt that setup for the test. Or running tests as a local, non admin, user and one does not want to bother the admin with modifying the system sshd setup for those tests. Other reasons: Those doing it /instead/ of running on port 22 are usually doing it for one of at least two reasons: 1) a false sense of security. If you do an internet search, you'll find plenty of blog posts boasting that using an alternate port is a security feature (it is not, it is security via obscurity); or 2) to reduce the log growth from all the script kiddie scans that target port 22 (note, no security is added here, but one's log files don't grow quite as rapidly either).

clarry 7y ago

Significantly less log spam.

nucleardog 7y ago

Slighty reduces your risk from all the automated spam. Most things that are scanning the entire internet trying to brute force weak passwords and stuff aren't trying 65,000 ports on each host. Any sort of worm/botnet will probably be in the same situation. The only hosts we have with any SSH exposed to the world at all are a couple of bastion hosts. Day-to-day we access everything else through a VPN, so its only exposed at all as an emergency backup in case the VPN breaks. Really no inconvenience to having it moved to a high port.

h4waii 7y ago

IMHO, this isn't "security through obscurity" but it's a way of weeding out automated attacks and reducing logs filling up with completely avoidable entries. I'd say it has valid "sysadmin" reasons but not "security" ones. Given 2 boxes with the exact same SSH setup (key auth, fail2ban, or whatever else you use) I'd prefer to admin the one with a non-standard port solely for the fact that it's not undergoing constant attack which uses resources (albeit tiny).

matthew-hollick 7y ago

There are pros and cons. It does mean that you should get less ssh bot spam but it also means that you run ssh on a non privileged port - one that a malicious application running as non-root might attempt to exploit.

carlisle_ 7y ago

There's actually a good reason to not use SSH on a non-privileged port: It allows an unprivileged user to bind their own binary to the port when SSH restarts or otherwise stops listening.

nickodell 7y ago
That unprivileged user will not have the SSH host key, which will create a warning for any user who connects, just as though someone had conducted a man-in-the-middle attack. Of course, there are plenty of privileged ports to choose from. https://www.google.com/search?q=random+number+between+1+and+1023 https://www.google.com/search?q=random+number+between+1+and+...

__s 7y ago

I use Chrome SSH to ssh into my WSL2 debian instance on Windows 10. Native terminals don't support mouse events. But port 22 can already be in use by the host system, so I have WSL2 configured to listen on port 222