4 ms·
For me changing the default port for SSH achieved much of the same result at an even lower cost IMO. That is, unless you're high profile enough that attackers m
by simias 6y ago
For me changing the default port for SSH achieved much of the same result at an even lower cost IMO. That is, unless you're high profile enough that attackers might want to target your server specifically and you're not just randomly scanned by botnets which won't generally bother looking beyond port 22.
- ape4 6y agoPut ssh on port 80 and http on port 22 - perfect security ;)
- metalliqaz 6y agofor my internet-facing machines I black-hole everything below 1024 and move SSH to something high but easy enough to remember like 22222
- snazz 6y agoMy latest trick for deciding on external ports to forward is to combine the service port and the device's internal IP address. If my desktop was 10.0.1.36 and the service was SSH on port 22, the external port would be 22136. So far it's worked well, but it only really works if you force your router to only give out 10.0.1.2 through 10.0.1.99.
- ape4 6y agoIf I was an evil hacker I would look at that port and other variants of 22 like 2200, 2222, etc for people's ssh.
- metalliqaz 6y agoand then all you'd have to do is compromise SSH on my fully patched system of course the point is not to be able to withstand an attack by a persistent attacker. it prevents my logs from filling up with the constant scans from scripts
- hylaride 6y agoI had to disable "insecure" ciphers on my bastion SSH hosts at work so that we could pass a security audit. The interesting side effect was that a substantial number of scans failed because the scanning software didn't support them: Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512
- koheripbal 6y agoSame with RDP. Hackers don't even bother to scan outside of 3389. My logs are empty.