5 ms·

So very true. Thats why i, for private things, never bother with domain names, signed certs, and use non standard ports. All of the above are huge lawn signs f

So very true. Thats why i, for private things, never bother with domain names, signed certs, and use non standard ports. All of the above are huge lawn signs for "target". This of course drives all sorts of chrome browsers and mitm stuff bonkers. So the next time someone asks why you dont want to buy into the dns/cert route, tell them this. Inb4, i know the whole subsequent argument chain, nevertheless, this reduces the activity. yes, yes it does.

dspillett 3y ago
> this reduces the activity. yes, yes it does. Does it reduce it quantifiably, and usefully, long term? I've had the discussion about running SSHd on a non-standard port with a few people over the years. I've never been convinced that saving a bit of log file space is worth the reconfiguration time, nor that the security benefits are significant (assuming a secure config otherwise of course) given that at least some sophisticated actors prove I non-standard ports for the presence of services.
- xvector 3y ago
  There have been 0days in sshd. Typically automatic attack scanners don't bother with nonstandard ports when carrying out these attacks. So I would say yes, it's worth it.
  - mistrial9 3y ago
    you mean Heartbleed? what else..
- justsomehnguy 3y ago
  > I've never been convinced that saving a bit of log file space sigh It's not the log file space, it absence of failed attempts in the logs.
  - bigiain 3y ago
    Yep. Especially if there's a suspected incident or a new vulnerability announced, I'd much rather be reading port 2234 sshd logs that port 22 sshd logs - far less haystack to wade through looking for needles. And as another comment mentions, every time an sshd zero day is announced, pretty much the entire IPv4 address space gets probed on port 22 within about 30 minutes. A non standard port number _might_ buy you an extra hour or three if you've got a vulnerable sshd. But don't rely on that - someone's bound to have portscanned you recently enough and knows you've got OpenSSH_8.2p1 listening on port 2234 (or whatever) and they won't be far behind the whole-internet port 22 exploit probes.
- drpixie 3y ago
  I've certainly had lots of login probes at common non-standard ports - 22+n for easy to remember n. But it's nice to have the logs reasonably clean, makes it easier to see real problems.
- throw0101b 3y ago
  > I've never been convinced that saving a bit of log file space is worth the reconfiguration time […] This is relatively easy to do with Ansible (or whatever). My main concern as a sysadmin in a company is user training and telling folks to use the non-standard ports. If I could use SRV records for 'service (port) discovery' that'd be helpful.
  - matthews2 3y ago
    > My main concern as a sysadmin in a company is user training and telling folks to use the non-standard ports. Could you ship and manage SSH config files for your users?
rajamaka 3y ago
Kind of throwing the baby out with the bathwater no? Just block the ports/traffic and enjoy the convenience of DNS / signed certs.
nyanpasu64 3y ago
I think that requiring world-visible TLS certificates for LAN-local web services compromises the privacy of the infrastructure I run in my bedroom for my own usage.
- lysp 3y ago
  I use a wildcard for mine. *.locallan.domain.com It exposes part of the domain, but none of the services. If you want to be even more secure, you could null-IP the wildcard and only allocate IPs for subdomains that you use.

dspillett 3y ago

> this reduces the activity. yes, yes it does. Does it reduce it quantifiably, and usefully, long term? I've had the discussion about running SSHd on a non-standard port with a few people over the years. I've never been convinced that saving a bit of log file space is worth the reconfiguration time, nor that the security benefits are significant (assuming a secure config otherwise of course) given that at least some sophisticated actors prove I non-standard ports for the presence of services.

xvector 3y ago
There have been 0days in sshd. Typically automatic attack scanners don't bother with nonstandard ports when carrying out these attacks. So I would say yes, it's worth it.
- mistrial9 3y ago
  you mean Heartbleed? what else..
justsomehnguy 3y ago
> I've never been convinced that saving a bit of log file space sigh It's not the log file space, it absence of failed attempts in the logs.
- bigiain 3y ago
  Yep. Especially if there's a suspected incident or a new vulnerability announced, I'd much rather be reading port 2234 sshd logs that port 22 sshd logs - far less haystack to wade through looking for needles. And as another comment mentions, every time an sshd zero day is announced, pretty much the entire IPv4 address space gets probed on port 22 within about 30 minutes. A non standard port number _might_ buy you an extra hour or three if you've got a vulnerable sshd. But don't rely on that - someone's bound to have portscanned you recently enough and knows you've got OpenSSH_8.2p1 listening on port 2234 (or whatever) and they won't be far behind the whole-internet port 22 exploit probes.
drpixie 3y ago
I've certainly had lots of login probes at common non-standard ports - 22+n for easy to remember n. But it's nice to have the logs reasonably clean, makes it easier to see real problems.
throw0101b 3y ago
> I've never been convinced that saving a bit of log file space is worth the reconfiguration time […] This is relatively easy to do with Ansible (or whatever). My main concern as a sysadmin in a company is user training and telling folks to use the non-standard ports. If I could use SRV records for 'service (port) discovery' that'd be helpful.
- matthews2 3y ago
  > My main concern as a sysadmin in a company is user training and telling folks to use the non-standard ports. Could you ship and manage SSH config files for your users?

rajamaka 3y ago

Kind of throwing the baby out with the bathwater no? Just block the ports/traffic and enjoy the convenience of DNS / signed certs.

nyanpasu64 3y ago

I think that requiring world-visible TLS certificates for LAN-local web services compromises the privacy of the infrastructure I run in my bedroom for my own usage.

lysp 3y ago
I use a wildcard for mine. *.locallan.domain.com It exposes part of the domain, but none of the services. If you want to be even more secure, you could null-IP the wildcard and only allocate IPs for subdomains that you use.