3 ms·

> I changed the server to listen on standard port 22 and tried connecting via the hostname once again. Holy crap, it worked. Shocking! Granted high ports shou

> I changed the server to listen on standard port 22 and tried connecting via the hostname once again. Holy crap, it worked. Shocking! Granted high ports shouldn't be broken, but running SSH on a non-standard port is security (read obscurity) theater at best. There's really not much benefit, unless you need multiple sshds on the same IP, but at that point I'd question the sanity of the approach.

notyourday 7y ago
For me SSH on a standard port get connection attempts and every few minutes. SSH on a non-standard port get connections attempts every few weeks.
lukevp 7y ago
Security through obscurity shouldn’t be used as an edict that something is not effective. You are talking about the fact that it doesn’t increase the security of the protocol itself or the passphrases/keys used. This is true. However, there are tons of bots out there that scan 22 and try to exploit common logins. There are presumably quite a few less that are port scanning every machine for every possible high port and attempting to handshake ssh and then try logins. Do you disagree with that? If not, this is not security through obscurity, it has a very real impact on the volume of bots that have knowledge that this service is running and are actively exploiting it. It’s just a different type of security, it’s discoverability of the service. Here’s another example. Say you have a web server running that is only for internal employee use. But you want to expose it externally so that they can reach it without a VPN. Even if you follow proper security protocols, why would you not turn off search engine indexing on this page, and limit the pages that link to it? It will not increase the inherent security of the protocol or the user accounts, but it will drastically lower the # of bots using up CPU and iptables entries trying to fail2ban or blacklist them. Security is a spectrum and you want to have defense in depth. Moving ssh to a nonstandard port is a security best practice and you shouldn’t be advising people not to use it. But should they also have good key setting, fail2ban, ip whitelisting/blacklisting, etc? Of course they should.
- deeblering4 7y ago
  > Moving ssh to a nonstandard port is a security best practice For whom? Could you please cite this?
dade_ 7y ago
In time, any server with port 22 exposed to the Internet will have a system log with hundreds of failed authentication attempts per minute from IP addresses all over the world. By simply moving it to a high port number, the attempts are rare and troubleshooting is easier without all the noise. And it is script kiddies, typically the login is root, ubuntu, or similar and a password of password, god, other silly things that people actually use.
- jbverschoor 7y ago
  Or you can just firewall the box?

notyourday 7y ago

For me SSH on a standard port get connection attempts and every few minutes. SSH on a non-standard port get connections attempts every few weeks.

lukevp 7y ago

Security through obscurity shouldn’t be used as an edict that something is not effective. You are talking about the fact that it doesn’t increase the security of the protocol itself or the passphrases/keys used. This is true. However, there are tons of bots out there that scan 22 and try to exploit common logins. There are presumably quite a few less that are port scanning every machine for every possible high port and attempting to handshake ssh and then try logins. Do you disagree with that? If not, this is not security through obscurity, it has a very real impact on the volume of bots that have knowledge that this service is running and are actively exploiting it. It’s just a different type of security, it’s discoverability of the service. Here’s another example. Say you have a web server running that is only for internal employee use. But you want to expose it externally so that they can reach it without a VPN. Even if you follow proper security protocols, why would you not turn off search engine indexing on this page, and limit the pages that link to it? It will not increase the inherent security of the protocol or the user accounts, but it will drastically lower the # of bots using up CPU and iptables entries trying to fail2ban or blacklist them. Security is a spectrum and you want to have defense in depth. Moving ssh to a nonstandard port is a security best practice and you shouldn’t be advising people not to use it. But should they also have good key setting, fail2ban, ip whitelisting/blacklisting, etc? Of course they should.

deeblering4 7y ago
> Moving ssh to a nonstandard port is a security best practice For whom? Could you please cite this?

dade_ 7y ago

In time, any server with port 22 exposed to the Internet will have a system log with hundreds of failed authentication attempts per minute from IP addresses all over the world. By simply moving it to a high port number, the attempts are rare and troubleshooting is easier without all the noise. And it is script kiddies, typically the login is root, ubuntu, or similar and a password of password, god, other silly things that people actually use.

jbverschoor 7y ago
Or you can just firewall the box?