3 ms·

> When that happens, the list of vulnerable servers is "everyone running SSH". Agreed, but in between "bad guys discover vulnerability" and "he fixes vulnerabi

by philh 15y ago

> When that happens, the list of vulnerable servers is "everyone running SSH". Agreed, but in between "bad guys discover vulnerability" and "he fixes vulnerability", can't he reduce the chance that he will be attacked by having SSH on a different port? It won't stop someone who's targeting him, but it might keep him off the radar of someone who's just looking for easy targets. From another post: > "32,000" sounds like a large number on a message board, but write an evented port scanner† and see how big that number really is. So is your claim that anyone looking for vulnerable SSH servers will scan every port they can on a given IP, rather than just looking at port 22 and moving on? > I don't think it's hard to extract value from my comments. With respect, you are not the best judge of this. (I personally don't administer a server; if anything, I want you to be correct because that will save me effort if I ever do.) When I read your posts, I learn your opinion, but I often can't work out why you hold that opinion. Possibly you just write your posts under assumptions that seem obvious to you, but not to others.

tptacek 15y ago
One assumption I may have that needs to be stated: OpenSSH vulnerabilities are infrequent, bordering on rare. The discovery of a remote auth bypass or remote code exec flaw in OpenSSH is a big deal; a "drop everything and block all access to port 22" deal. Another assumption: the gap between the rumor of an OpenSSH remote and the time it hits "people so dumb as to burn the exploit on a scanner" is large; probably weeks, possibly months. Another assumption: anyone running OpenSSH has turned off the dumb stuff, like password authentication. If you are using passwords to log into SSH servers, you have problems port numbers can't fix. The only attacker SSH-on-port-51122 defends against is the one so far back in line for SSH exploits that she'll stick it on the business end of an Internet-wide scanner. That vulnerability is worth many tens of thousands of dollars. Nobody that has it in the window between announce and "public downloadable exploit" is scanning with it. Finally, you really should only have one machine exposed to SSH, if that. If you have to manage 50 servers, set up 1 bastion server and relay through it.

by philh 15y ago

tptacek 15y ago

One assumption I may have that needs to be stated: OpenSSH vulnerabilities are infrequent, bordering on rare. The discovery of a remote auth bypass or remote code exec flaw in OpenSSH is a big deal; a "drop everything and block all access to port 22" deal. Another assumption: the gap between the rumor of an OpenSSH remote and the time it hits "people so dumb as to burn the exploit on a scanner" is large; probably weeks, possibly months. Another assumption: anyone running OpenSSH has turned off the dumb stuff, like password authentication. If you are using passwords to log into SSH servers, you have problems port numbers can't fix. The only attacker SSH-on-port-51122 defends against is the one so far back in line for SSH exploits that she'll stick it on the business end of an Internet-wide scanner. That vulnerability is worth many tens of thousands of dollars. Nobody that has it in the window between announce and "public downloadable exploit" is scanning with it. Finally, you really should only have one machine exposed to SSH, if that. If you have to manage 50 servers, set up 1 bastion server and relay through it.