4 ms·

IME, moving ssh off the standard port reduces bot scanning traffic by >99%. Not only it means less noise in the logs (and thus higher SNR), but also lowers the

IME, moving ssh off the standard port reduces bot scanning traffic by >99%. Not only it means less noise in the logs (and thus higher SNR), but also lowers the chance you're hit by spray-and-pray in case there's a zero day in sshd (or any other daemon really).

augusto-moura 1y ago
True, but I hardly open any ssh to the wide world. I would only allow it inside a closed network anyways. HTTP on the other hand _needs_ to be exposed on 80 or 443 (not technically, but in practice)
lelanthran 1y ago
> IME, moving ssh off the standard port reduces bot scanning traffic by >99%. Depends on the site I expect. My low value domains get NO ssh attempts on my random ports. The high value ones get a few each week.
godelski 1y ago
You could also always add port knocking or something like that.
- yjftsjthsd-h 1y ago
  If you're going to that level, just put it behind a VPN.
  - godelski 1y ago
    Tailscale is a VPN... The context of the conversation is that the address becomes publicly visible so you get hit with port scanners and script kiddies looking for vulns. Moving off standard ports does help but many of those are also going to look at ports like 2222 or 8022 and treat them as ssh. It's not hard to just send something like `nmap -sV -p- <ADDRESS>` (or better, use like rustscan.) and you'll discover those ports and the services. On the other hand, just install something like knocked and you don't have to do much. Knocking is not a difficult thing to set up.
    - yjftsjthsd-h 1y ago
      > Tailscale is a VPN... And if you use it as a VPN and don't turn on the funnel feature, your service won't be exposed. > On the other hand, just install something like knocked and you don't have to do much. Knocking is not a difficult thing to set up. Neither is wireguard.
      - godelski 1y ago
        lol your solution to a problem caused by a feature is "don't use that feature?" LGTM Presumably wireguard was already being used?

augusto-moura 1y ago

True, but I hardly open any ssh to the wide world. I would only allow it inside a closed network anyways. HTTP on the other hand _needs_ to be exposed on 80 or 443 (not technically, but in practice)

lelanthran 1y ago

> IME, moving ssh off the standard port reduces bot scanning traffic by >99%. Depends on the site I expect. My low value domains get NO ssh attempts on my random ports. The high value ones get a few each week.

godelski 1y ago

You could also always add port knocking or something like that.

yjftsjthsd-h 1y ago
If you're going to that level, just put it behind a VPN.
- godelski 1y ago
  Tailscale is a VPN... The context of the conversation is that the address becomes publicly visible so you get hit with port scanners and script kiddies looking for vulns. Moving off standard ports does help but many of those are also going to look at ports like 2222 or 8022 and treat them as ssh. It's not hard to just send something like `nmap -sV -p- <ADDRESS>` (or better, use like rustscan.) and you'll discover those ports and the services. On the other hand, just install something like knocked and you don't have to do much. Knocking is not a difficult thing to set up.
  - yjftsjthsd-h 1y ago
    > Tailscale is a VPN... And if you use it as a VPN and don't turn on the funnel feature, your service won't be exposed. > On the other hand, just install something like knocked and you don't have to do much. Knocking is not a difficult thing to set up. Neither is wireguard.
    - godelski 1y ago
      lol your solution to a problem caused by a feature is "don't use that feature?" LGTM Presumably wireguard was already being used?