3 ms·
>obscuring your login service via non-standard ports or even a requirement to try several ports in sequence really only buys you security equivalent to lengthen
by mistercow 14y ago
>obscuring your login service via non-standard ports or even a requirement to try several ports in sequence really only buys you security equivalent to lengthening your password by two characters per port.
Not even that. It's like a separate two-byte password because you get to guess and confirm the port separately from the password.
Lengthening your password by N bits multiplies the number of necessary guesses by 2^N. Having a separate N bit password adds 2^N to the number of of necessary guesses. So if your real password's effective key length is more than 16 bits, using a random port effectively adds less than 1 bit of entropy.
Also, rate-limiting port scans is way harder to do than rate-limiting authentication.
- lflux 14y agoYou shouldn't be using passwords anyway, you should be using key-based authentication.
- martinced 14y agoWhich is better: to have someone hack into your machine and install a keylogger and wait for you to connect to your servers using SSH to get your passwords or someone hacking into your machine and stealing immediately the private keys!?
- lflux 14y agoWhy would you have private keys on the server? Those are passphrase-protected on your laptop/workstation.
- cpressey 14y agoIt occurred to me that if you want to multiply the number of necessary guesses by running sshd on an alternate port, you'd need to run multiple sshds. (Of course all but one of these sshds should be decoys.) Doubling the number of sshds is then like adding one bit to the password.
- xyzzy123 14y agoI'm not sure I completely understand you, but I think the original author was referring to: https://help.ubuntu.com/community/PortKnocking https://help.ubuntu.com/community/PortKnocking
- cynwoody 14y agoThe likely result of that would be that a smart hacker would cross you off his IP list upon discovering you are running a bunch of sshds. After all, if you are devious enough to do that, it's unlikely your real sshd will fall to his script in any case. You are a waste of bandwidth better spent chasing low-hanging fruit.