3 ms·
> * changing your SSH port to non-root port (>1024) means that if the SSH daemon dies, any userland process can take its' place. this is bad. If you're relying
by theandrewbailey 3y ago
> * changing your SSH port to non-root port (>1024) means that if the SSH daemon dies, any userland process can take its' place. this is bad.
If you're relying on privileged ports, you've already lost the battle.
- lxgr 3y agoThis doesn't even have to happen maliciously. Even if it happens by accident, it can result in locking yourself out of a server.
- closewith 3y agoDefense in depth.
- o11c 3y agoSpecifically: * your SSH client will check the host certificate. There's a reason it does that prompt for new hosts! * a userland process can no more MITM that than any random middlebox can.
- pepa65 3y agoAnd you can always use net.ipv4.ip_local_reserved_ports to reserve the port for privileged use. (I have never had to do this in over a decade of using a high port for ssh access.)