3 ms·

Changing SSH port is far more efficacious at reducing nonsense than the Twitter poll in the article suggests: > "I ran an experiment with a virtual machine exp

by miles 6y ago

Changing SSH port is far more efficacious at reducing nonsense than the Twitter poll in the article suggests: > "I ran an experiment with a virtual machine exposed to the internet which had sshd listening on port 22. The server stayed online for one week and then I changed the ssh port to 222. The number of attacks dropped by 98%. Even though this is solely empirical evidence, it’s clear that moving off the standard ssh port reduces your server’s profile."[0] > "In the time that I gathered 7,025 connection attempts to my SSH daemon on port 22 I received 3 on port 24."[1] Also, great top comment by 16s[2] in this HN thread, "Why putting SSH on another port than 22 is bad idea".[3] [0] https://major.io/2013/05/14/changing-your-ssh-servers-port-from-the-default-is-it-worth-it/ https://major.io/2013/05/14/changing-your-ssh-servers-port-f... [1] https://danielmiessler.com/blog/security-and-obscurity-does-changing-your-ssh-port-lower-your-risk/ https://danielmiessler.com/blog/security-and-obscurity-does-... [2] https://news.ycombinator.com/item?id=6615994 https://news.ycombinator.com/item?id=6615994 [3] https://news.ycombinator.com/item?id=6615734 https://news.ycombinator.com/item?id=6615734

rjkennedy98 6y ago
It's also way less effective than they mentioned because they didn't get hacked either way. So there was 0% difference in effectiveness between port 24 and 22 since the ssh was properly configured. Security by obscurity only matters if you aren't secure in the first place. It can be a good extra layer of protection, but the worst examples of security mishaps I've seen are because people find the security unnecessarily burdensome and so they bypass it entirely. So in that way obscurity in that case has a real cost.
- 10000truths 6y ago
  Even unsuccessful SSH attempts can have operational costs, though. The machine still accepts the TCP connection and does the SSH handshake. If I’m running a server and I’m billed by data usage or by vCPU minutes, I don’t want to waste my allotted resources by making it easy for every half-baked crawler around the world to make connections to my machine. Using a non-default port cuts down those numbers significantly. Sure, a targeted attack won’t be thwarted, but at least the server is not being DDoS’ed anymore.

by miles 6y ago

rjkennedy98 6y ago

It's also way less effective than they mentioned because they didn't get hacked either way. So there was 0% difference in effectiveness between port 24 and 22 since the ssh was properly configured. Security by obscurity only matters if you aren't secure in the first place. It can be a good extra layer of protection, but the worst examples of security mishaps I've seen are because people find the security unnecessarily burdensome and so they bypass it entirely. So in that way obscurity in that case has a real cost.

10000truths 6y ago
Even unsuccessful SSH attempts can have operational costs, though. The machine still accepts the TCP connection and does the SSH handshake. If I’m running a server and I’m billed by data usage or by vCPU minutes, I don’t want to waste my allotted resources by making it easy for every half-baked crawler around the world to make connections to my machine. Using a non-default port cuts down those numbers significantly. Sure, a targeted attack won’t be thwarted, but at least the server is not being DDoS’ed anymore.