5 ms·

I don't think it matters, ssh bots will try any port that sends back the ssh banner.

freedomben 3y ago
The more targeted/sophisticated ones will, but there's a crapload of bots that just scan all publicly addressable IPs for port 22 and attempt to connect. If your goal is to trap as many bots as possible in the tarpit, you'll get a lot more if you run on port 22.
- deleted 3y ago
  [deleted]
skrause 3y ago
But they don't scan every port. I've been running my SSH server on a non-standard port for a long time, it took four years until I had the first bot with login attempts. About a year ago I changed the port and haven't seen any bots since then.
- qwertox 3y ago
  You can surround your custom port by a couple of ports on which a simple server listens for connection attempts. Any connection attempt is considered hostile and the ip will then be blacklisted in iptables. This prevents portscans from reaching your port.
  - metadat 3y ago
    Only works for sequential scans, most scanners are more targeted towards specific services.
    - AlecSchueler 3y ago
      If they're targetting SSH specifically how are they going to guess i'm running it on port 1690 and not port 22 other than by scanning up in sequence?
      - kevindamm 3y ago
        Different quality of locks in the ever-escalating arms race. Probably there are many many more sequential scanners out there. For the persistent actors who are doing random ordering or shuffle then you could add port-knocking for the real sshd... but then they just have to find a working client and sniff the connection requests... to which you add a TOTP step for determining which ports to use, and so on...
      - dambi0 3y ago
        There is a known upper bound they could randomise the guesses from the range.
    - yard2010 3y ago
      Excuse the old school metaphor - you put a lock on your door so your house is harder to break into, not to prevent anyone from breaking into your house.
      - metadat 3y ago
        Absolutely agree, when I wrote this I was thinking more of defending against the low hanging fruit - mass scanners. Once someone has deemed you a worthwhile target and is carefully proving all ports, these more nuanced approaches become more worthwhile. Even then, a sophisticated adversary may have many unique src IPs at their disposal.
  - deleted 3y ago
    [deleted]
michaelcampbell 3y ago
That's the theory. I have an internet facing box using ssh on a weird port with fail2ban on it just in case. In over 10 years I've never had a single probe on that port with ssh.
- AlecSchueler 3y ago
  Same, I went from logging thousands of attempts per day to zero per decade with a simple switch of ports.
michaelcampbell 3y ago
They CAN, but they don't.

The more targeted/sophisticated ones will, but there's a crapload of bots that just scan all publicly addressable IPs for port 22 and attempt to connect. If your goal is to trap as many bots as possible in the tarpit, you'll get a lot more if you run on port 22.

deleted 3y ago
[deleted]

skrause 3y ago

But they don't scan every port. I've been running my SSH server on a non-standard port for a long time, it took four years until I had the first bot with login attempts. About a year ago I changed the port and haven't seen any bots since then.

qwertox 3y ago
You can surround your custom port by a couple of ports on which a simple server listens for connection attempts. Any connection attempt is considered hostile and the ip will then be blacklisted in iptables. This prevents portscans from reaching your port.
- metadat 3y ago
  Only works for sequential scans, most scanners are more targeted towards specific services.
  - AlecSchueler 3y ago
    If they're targetting SSH specifically how are they going to guess i'm running it on port 1690 and not port 22 other than by scanning up in sequence?
    - kevindamm 3y ago
      Different quality of locks in the ever-escalating arms race. Probably there are many many more sequential scanners out there. For the persistent actors who are doing random ordering or shuffle then you could add port-knocking for the real sshd... but then they just have to find a working client and sniff the connection requests... to which you add a TOTP step for determining which ports to use, and so on...
    - dambi0 3y ago
      There is a known upper bound they could randomise the guesses from the range.
  - yard2010 3y ago
    Excuse the old school metaphor - you put a lock on your door so your house is harder to break into, not to prevent anyone from breaking into your house.
    - metadat 3y ago
      Absolutely agree, when I wrote this I was thinking more of defending against the low hanging fruit - mass scanners. Once someone has deemed you a worthwhile target and is carefully proving all ports, these more nuanced approaches become more worthwhile. Even then, a sophisticated adversary may have many unique src IPs at their disposal.
- deleted 3y ago
  [deleted]

michaelcampbell 3y ago

That's the theory. I have an internet facing box using ssh on a weird port with fail2ban on it just in case. In over 10 years I've never had a single probe on that port with ssh.

AlecSchueler 3y ago
Same, I went from logging thousands of attempts per day to zero per decade with a simple switch of ports.

michaelcampbell 3y ago

They CAN, but they don't.