3 ms·
This, and move the endpoint on an uninteresting port to lower the noise in the logs
by BrandoElFollito 3y ago
This, and move the endpoint on an uninteresting port to lower the noise in the logs
- KMag 3y ago... and avoid automated attacks in case a 0-day in the pre-authentication OpenSSH server code shows up
- hsbauauvhabzb 3y agoIf there’s a preauth RCE in ssh, I’m sure threat actors will start scanning non default ports once their hornets have hit critical mass.
- NoZebra120vClip 3y agoI suppose it may do that, but naïvely switching to an alternate port may lull one into a false sense of security: https://utcc.utoronto.ca/~cks/space/blog/sysadmin/SSHAltPortNoSecurity https://utcc.utoronto.ca/~cks/space/blog/sysadmin/SSHAltPort... Shodan will find and fingerprint you easily enough.
- michaelcampbell 3y agoIn theory. I have a server running on a weird port, but with fail2ban just in case. I haven't had even a blip of an attempt on it.