3 ms·
Port 22: I always change it to something else and bots leave my servers alone. I wonder why they don't try all the ports. I understand it's 16 bits but they sho
by pmontra 5y ago
Port 22: I always change it to something else and bots leave my servers alone. I wonder why they don't try all the ports. I understand it's 16 bits but they should do it only for the addresses that don't answer on port 22.
- xxpor 5y agothe vast vast majority of addresses aren't going to respond on port 22. Lets say there's 2,000,000 IPv4 addresses that are being used on the internet. If you scan 64,511 ports on each of them (65536-1024-1), that's still 129,022,000,000 connection attempts. Probably not worth it.
- knorker 5y agoDoesn't help much when shodan has already portscanned everyone. I just searched for "ssh -port:22" and found many hits. But also yes. Switching port (or just blocking China) will vastly reduce SSH probes.
- egberts1 5y agoDon’t forget to block Brazil And Romania And Kazakhstan And …
- gary_0 5y agoLast time I looked at the IPs spamming my websites, a lot of them were from Europe, surprisingly.
- knorker 5y agoI'm not saying there aren't non-China probe spam. But without China it's just non-stop to the point of consuming noticeable amount of hard drive space for logs, and making it annoying to read logs looking for other things. At least that's my experience.
- User23 5y agoBack in the EFNet days everyone with a lick of sense autobanned all of Eastern Europe, Asia, and South America. It was literally nothing but script kiddies.
- seized 5y agoAny decent firewall can do geo location allow. I block all but specific counties. Can't trust Christmas Island....
- zamadatix 5y agoThe real search space is 48 bits (IP+port) 281,474,976,710,656. Searching at 1 million destinations per second it'd take ~9 years. So options are either go build something in the billion destinations per second range (completely feasible just more work to not get blocked) or just to limit the search space. Throwing out unadvertised IP space and throw out around 99.998% of the remaining destinations by just doing port 22 allows you to scan the entire internet extremely quickly with the smallest of scanning setups.