4 ms·

Using a random port for SSH (or even "better", port knocking) is a "clever trick", until you forget the one you used for that server that quietly runs on which

Using a random port for SSH (or even "better", port knocking) is a "clever trick", until you forget the one you used for that server that quietly runs on which you log once every two years. Then it can range from minor annoyance to major PITA. Security by obfuscation has the potential to confuse some (mostly dumb) attackers, but it has also the potential to confuse your future self, for VERY minor benefits (since everyone agrees but most of your security should not come from security-through obfuscation anyway). Hence, avoid.

smitty1e 4y ago
One would think that if a list of services were going to be bound to non-standard ports, that would be an occasion to document very, very carefully.
alerighi 4y ago
You can maintain a .ssh/config file with all the port that you used (and backup it) or use always the same custom port. Anyway, it is useless but it can avoid all sort of bots trying out common login to your SSH server, that consumes resources (even if minimal) and fills your logs.
- anjbe 4y ago
  > You can maintain a .ssh/config file with all the port that you used (and backup it) Once you start distributing config files to all your clients you might as well switch to keypair authentication, which so completely reduces risk of intrusion that leaving sshd on 22 simply does not matter. > that consumes resources (even if minimal) I suspect practically immeasurable.
- amelius 4y ago
  How do you pick a good port number that doesn't clash now and in the future? Ps: it is a disgrace that the network/kernel still uses port numbers rather than names, which would be much more flexible.
hotpotamus 4y ago
I would say that every attacker I've ever encountered was dumb in the sense that it's a bot just scanning around. For ssh, I'm amazed by 2 things - 1, how quick a new server with 22 open on a public IP will be found and attempted to be compromised by brute force guessing, and 2, how changing the port (even to an obvious one like 2222) will eliminate all that noise. I suppose you could say that the attackers are filtering out anyone who has done some basic hardening, but I suspect the truth is mostly more mundane - the attackers just aren't that motivated/clever; at least the ones who mass scan the internet trying to compromise ssh.

smitty1e 4y ago

One would think that if a list of services were going to be bound to non-standard ports, that would be an occasion to document very, very carefully.

alerighi 4y ago

You can maintain a .ssh/config file with all the port that you used (and backup it) or use always the same custom port. Anyway, it is useless but it can avoid all sort of bots trying out common login to your SSH server, that consumes resources (even if minimal) and fills your logs.

anjbe 4y ago
> You can maintain a .ssh/config file with all the port that you used (and backup it) Once you start distributing config files to all your clients you might as well switch to keypair authentication, which so completely reduces risk of intrusion that leaving sshd on 22 simply does not matter. > that consumes resources (even if minimal) I suspect practically immeasurable.
amelius 4y ago
How do you pick a good port number that doesn't clash now and in the future? Ps: it is a disgrace that the network/kernel still uses port numbers rather than names, which would be much more flexible.

hotpotamus 4y ago

I would say that every attacker I've ever encountered was dumb in the sense that it's a bot just scanning around. For ssh, I'm amazed by 2 things - 1, how quick a new server with 22 open on a public IP will be found and attempted to be compromised by brute force guessing, and 2, how changing the port (even to an obvious one like 2222) will eliminate all that noise. I suppose you could say that the attackers are filtering out anyone who has done some basic hardening, but I suspect the truth is mostly more mundane - the attackers just aren't that motivated/clever; at least the ones who mass scan the internet trying to compromise ssh.