3 ms·
I stopped changing my ssh port once I learned low ports can only be taken be processes started as root. And then I realized I won't expose ssh port or any other
by ramtatatam 6y ago
I stopped changing my ssh port once I learned low ports can only be taken be processes started as root. And then I realized I won't expose ssh port or any other management port except my vpn port...
- acdha 6y agoNote that the root restriction isn’t strictly true any more: for example, on Linux you could grant the CAP_NET_BIND_SERVICE capability to a process and run it as a non-root user. If you have network services running as root just to be able to bind a low port, you could avoid that. In the case of sshd, of course, it would also need permission to start sessions as another user.
- ramtatatam 6y agoI only do this for nginx serving content on http(s) ports, but of course technically if my host got compromised an attacker could do the same for ssh port. But at this point (having root) he/she would not have to do this (I don't use passwords) and I would be already doomed :)