> I do hope one takes the vigilance to set a port number sufficiently high up, and sufficiently random looking Hopefully not over port 1023. If a user gets on

> I do hope one takes the vigilance to set a port number sufficiently high up, and sufficiently random looking Hopefully not over port 1023. If a user gets on the system and crashes your ssh daemon through OOM killer or one of many other methods, that non-root user can then restart its own daemon and listen to that port that you put >1023 'for security reasons'. Accidentally answering yes when it says a new key was detected is all it takes to get keylogged.