3 ms·
But that's putting the second line of defence (against an on-system attacker) above the first, which is to not get someone on the system in the first place. It
by Sebb767 6y ago
But that's putting the second line of defence (against an on-system attacker) above the first, which is to not get someone on the system in the first place. It definitely makes sense in some setups, but for your general purpose web server a high port is probably the right trade-off.
- cthalupa 6y agoHow many remote code execution exploits have we seen on webs applications? Many thousands. But you don't need to make this trade off. SSH does not need to be open to the internet to begin with - make it only accessible via VPN. Now you don't have log spam from botnets in your logs, and it won't show up on a port scan that has fingerprinting enabled and scans the whole range, and you won't be as vulnerable if some sort of sshd exploit comes out that allows you to bypass auth.
- Sebb767 6y agoOh, don't get me wrong, I fully agree with you. My point was only that if you see it as an either-or-scenario[0], the higher port is probably the better choice. [0] Might be true for something like a bastion host, which must expose ssh or VPN (which would be the same scenario).