4 ms·

So... Are you saying that moving your ssh port to a different address doesn't actually increase your security at all? In my practice it gets rid of ~95% of prob

So... Are you saying that moving your ssh port to a different address doesn't actually increase your security at all? In my practice it gets rid of ~95% of probes from people trying to break into my system. Whether it just signals that I know what I'm doing, or demands resources that the attackers aren't willing to give, I don't know, but it definitely has a positive effect on the security of my system.

DominoTree 6y ago
He's saying that it doesn't make your SSH configuration or SSH itself any more secure.
SassyGrapefruit 6y ago
>So... Are you saying that moving your ssh port to a different address doesn't actually increase your security at all No I think if you read particularly the "Why all the hate..." paragraph you'll see I'm saying the opposite of that. There is nothing wrong with obscurity but in terms of security its the icing not the cake. By that I mean it will make a secure setup more secure, but its not enough on its own.
enkid 6y ago
Aren't most SSH probes trying to break weak passwords? If so, having a strong password is much much more important than the port SSH is on.
- bostik 6y ago
  Really, you should not be using passwords at all. We have key-based authentication for a reason.
  - enkid 6y ago
    Totally agree.
- worik 6y ago
  Walk and chew gum.
ReptileMan 6y ago
>So... Are you saying that moving your ssh port to a different address doesn't actually increase your security at all? Having a quagmire next to your castle walls don't makes your walls harder to breach, just buys you more time until the enemy gets there. It's not bad thing to have, but ... just don't build your walls lower and thinner next to the swamp.
brobinson 6y ago
Building a house and putting the front door on the side or back of the house doesn't change the security of the door. Whether it has a weak lock or not doesn't depend on its location.
joking 6y ago
it doesn't increase the security at all, but is really convenient as you filter most of automatic attacks and have much less noise to filter through.
- yoz-y 6y ago
  Would banning any IP that tries connecting on 22 increase security?
  - joking 6y ago
    how do you connect rightfully then? at that point is easier to have and access rule on the firewall and only accept connections from the allowed ips.
  - bee_rider 6y ago
    You could do something like that, but you'd have to write it yourself. If you want to ban IP addresses, fail2ban is probably an easier starting point. Plus users who authenticate with passwords might occasionally make typos and get banned, incentivizing better logon techniques.
  - Macha 6y ago
    For my random high numbered IP ssh port, I see 5-15 attempts per day. In the last 3 months, the most failed attempts from a single IP is 3. Most attackers (at least amongst those that try higher ports) are distributed these days.

DominoTree 6y ago

He's saying that it doesn't make your SSH configuration or SSH itself any more secure.

SassyGrapefruit 6y ago

>So... Are you saying that moving your ssh port to a different address doesn't actually increase your security at all No I think if you read particularly the "Why all the hate..." paragraph you'll see I'm saying the opposite of that. There is nothing wrong with obscurity but in terms of security its the icing not the cake. By that I mean it will make a secure setup more secure, but its not enough on its own.

enkid 6y ago

Aren't most SSH probes trying to break weak passwords? If so, having a strong password is much much more important than the port SSH is on.

bostik 6y ago
Really, you should not be using passwords at all. We have key-based authentication for a reason.
- enkid 6y ago
  Totally agree.
worik 6y ago
Walk and chew gum.

ReptileMan 6y ago

>So... Are you saying that moving your ssh port to a different address doesn't actually increase your security at all? Having a quagmire next to your castle walls don't makes your walls harder to breach, just buys you more time until the enemy gets there. It's not bad thing to have, but ... just don't build your walls lower and thinner next to the swamp.

brobinson 6y ago

Building a house and putting the front door on the side or back of the house doesn't change the security of the door. Whether it has a weak lock or not doesn't depend on its location.

joking 6y ago

it doesn't increase the security at all, but is really convenient as you filter most of automatic attacks and have much less noise to filter through.

yoz-y 6y ago
Would banning any IP that tries connecting on 22 increase security?
- joking 6y ago
  how do you connect rightfully then? at that point is easier to have and access rule on the firewall and only accept connections from the allowed ips.
- bee_rider 6y ago
  You could do something like that, but you'd have to write it yourself. If you want to ban IP addresses, fail2ban is probably an easier starting point. Plus users who authenticate with passwords might occasionally make typos and get banned, incentivizing better logon techniques.
- Macha 6y ago
  For my random high numbered IP ssh port, I see 5-15 attempts per day. In the last 3 months, the most failed attempts from a single IP is 3. Most attackers (at least amongst those that try higher ports) are distributed these days.