4 ms·
Port 22 should only be used if the SSHd needs to be accessible to strangers; I think a lot of people use alternate ports. Go a step farther by running Kippo[1]
by charonn0 14y ago
Port 22 should only be used if the SSHd needs to be accessible to strangers; I think a lot of people use alternate ports. Go a step farther by running Kippo[1] (or other SSH honeypot) on port 22 to accept SSH traffic and waste attackers' time. Not only do attackers forgo scanning for the true SSH port, but they believe they've successfully intruded into the system and leave keystroke-by-keystroke logs of their actions in the decoy shell.
[1]: https://code.google.com/p/kippo/ https://code.google.com/p/kippo/
- martinced 14y agoVery interesting. A cool variant would be to, by default, offer the decoy shell on port 22 but also run the real SSH on port 22... But only activating it temporarily for the IP that just did succesfully port-knock. This should be trivial using some local redirection rules (so you'd run, say, SSH on port 19381 but use a transparent redirect to port 22 when an IP succesfully port-knocks in).