3 ms·

I've had this discussion many times with lots of people and my first argument is this: > $ telnet 10.136.3.215 22 > Trying 10.136.3.215... > Connected to 10.

I've had this discussion many times with lots of people and my first argument is this: > $ telnet 10.136.3.215 22 > Trying 10.136.3.215... > Connected to 10.136.3.215. > Escape character is '^]'. > SSH-2.0-OpenSSH_7.4p1 Debian-10+deb9u7 Isn't it kind of obvious? I mean, this is what I'd get regardless of whether it's 22 or 24000.

elmo2you 6y ago
It indeed is. If a port scanner does any analysis on the welcome banner, it's pretty obvious when you're dealing with an SSH server. That is, unless someone decided to run with a custom banner, which isn't something I have come across often in over two decades of experience (but I might not have recognized one if I saw one). The reality is that many (fast) scanners/script-kiddies often only scan for default ports. Changing the default port will lower your hit rate. It could be argued that this will only eliminate the less sophisticated attackers, which might hold some merit. However, good security is almost always a combination of factors that each add their own little contribution to the overall security. Even small increases can be worth it in the overall effort. Time is often an overlooked aspect within security. If you have SSH on an alternative port, you can use the detection of an inbound scan on the standard port to mitigate an subsequent scan/attack on your custom port. For instance by throwing the scanning IP address immediately in a deny ACL. Just a suggestion. Port knocking is also be an interesting concept, but a whole different discussion.
hatch_q 6y ago
Do you actually run any public server with ssh on 22 and monitoring logs about it? From my experience noise on port 22 is so high that you wouldn't even notice actual targeted attempt.
- axegon_ 6y ago
  No, I don't, but that has nothing to do with security and everything to do with routing. Noise is just as high on other ports so relying on moving a port or even a password is redundant as far as security is concerned. Personally I only have two servers which are publicly exposed to any form of ssh connections, both acting as access servers, nothing more. I've made several traps so if someone does manage to log in, I'll be immediately notified and I've also added a kill switch, so I can shut them down anytime with a click of a button.
  - hatch_q 6y ago
    Noise is not high on other ports. Noise on mine (when i changed port from 22) went from 100+ attempted logins every hour to 1 per week.
    - axegon_ 6y ago
      Well that's you, here's mine: > alex@srv002  ~  cat /var/log/auth.log | grep 'Disconnected\sfrom.*\[preauth' | wc -l > 432 All of those are from today...

elmo2you 6y ago

It indeed is. If a port scanner does any analysis on the welcome banner, it's pretty obvious when you're dealing with an SSH server. That is, unless someone decided to run with a custom banner, which isn't something I have come across often in over two decades of experience (but I might not have recognized one if I saw one). The reality is that many (fast) scanners/script-kiddies often only scan for default ports. Changing the default port will lower your hit rate. It could be argued that this will only eliminate the less sophisticated attackers, which might hold some merit. However, good security is almost always a combination of factors that each add their own little contribution to the overall security. Even small increases can be worth it in the overall effort. Time is often an overlooked aspect within security. If you have SSH on an alternative port, you can use the detection of an inbound scan on the standard port to mitigate an subsequent scan/attack on your custom port. For instance by throwing the scanning IP address immediately in a deny ACL. Just a suggestion. Port knocking is also be an interesting concept, but a whole different discussion.

hatch_q 6y ago

Do you actually run any public server with ssh on 22 and monitoring logs about it? From my experience noise on port 22 is so high that you wouldn't even notice actual targeted attempt.

axegon_ 6y ago
No, I don't, but that has nothing to do with security and everything to do with routing. Noise is just as high on other ports so relying on moving a port or even a password is redundant as far as security is concerned. Personally I only have two servers which are publicly exposed to any form of ssh connections, both acting as access servers, nothing more. I've made several traps so if someone does manage to log in, I'll be immediately notified and I've also added a kill switch, so I can shut them down anytime with a click of a button.
- hatch_q 6y ago
  Noise is not high on other ports. Noise on mine (when i changed port from 22) went from 100+ attempted logins every hour to 1 per week.
  - axegon_ 6y ago
    Well that's you, here's mine: > alex@srv002  ~  cat /var/log/auth.log | grep 'Disconnected\sfrom.*\[preauth' | wc -l > 432 All of those are from today...