5 ms·

Another "security through obscurity" pointless trick. If I'm attacking your server and it's not running SSH on port 22, it's a very short matter of time until I

Another "security through obscurity" pointless trick. If I'm attacking your server and it's not running SSH on port 22, it's a very short matter of time until I've found it anyway.

tomp 14y ago
Sure. It's only meant to stop automated script-kiddie attacks that target all open SSH servers on the internet. Less logs, less disk usage, ...
- drivebyacct2 14y ago
  Wouldn't the script-kiddie through those hosts into a queue to run a more advanced port scan on? I mean, I see your point, but it seems highly useless compared to, say, simply disabling the password based authentication.
  - lmm 14y ago
    Why would they bother? Script-kiddie is just playing the numbers, any machine with a slightly non-default configuration is not worth the effort. Disabling password authentication is better for "real" security, but doesn't stop those dictionary attacks spamming your logfile. (I still feel there should be better solutions to that problem than changing the port though)
    - drivebyacct2 14y ago
      I guess my response to all of these is... using key based auth is so much more secure than changing the port that changing the port seems to me, completely, pointless. Especially considering that: - password auth = me having to type my password everytime, likely to have a less secure password - key based auth = me never having to type it in, with a key length so long that it's completely inconceivable it'll be cracked or collided or brute forced and then when you change the port, the only "advantage" I get is that I now have to remember the port because they're already not getting in by virtue of key-based auth.
      - lenazegher 14y ago
        > using key based auth is so much more secure than changing the port Is it really? Once you get to a sensible password length (say, >14 characters) haven't you effectively made brute force and dictionary attacks impossible anyway? > password auth = me having to type my password everytime, likely to have a less secure password If you use a password often enough, I find the time difference between an 8 character and a 16 character password immeasurably small. It's all muscle memory anyway. >key based auth = me never having to type it in Perhaps I'm clinging to a false sense of security, but I find the idea of anyone with access to my local machine being able to access my server with 0 additional credentials really disconcerting. Perhaps in the theoretical world if they can access your machine it's game over anyway because they can install a keylogger. In the real world, I think there's a fairly large population of people who might access your server who wouldn't/couldn't install a keylogger to steal your password.
        majelix 14y ago
        > but I find the idea of anyone with access to my local machine being able to access my server with 0 additional credentials really disconcerting. You could hook whatever locks your screen to also clear your ssh-agent then. This is probably something like alias xlock=$(ssh-agent -k && xlock) in linux. You do lock your screen, right?
        jackalope 14y ago
        Your private key should have a strong passphrase. I agree that using a passphrase-less key is bad practice. As for keyloggers, once they obtain your password, they have succeeded. But after obtaining a key's passphrase (which you normally only type in once a local session if using ssh-agent), they still need the key, which may or may not be marginally harder. It's still another step to overcome. So, even if it can be shown to be only a narrow improvement over passwords under certain circumstances, it's a big win in convenience and even security under normal circumstances if done properly. Give it a try, finetune your ~/.ssh/config and you might end up loving it.
      - moe 14y ago
        The answer is really easy: You should do both. Disable password auth for root, and change the SSH port.
    - justinmk 14y ago
      > I still feel there should be better solutions to that problem than changing the port Well, there is port knocking. http://www.thoughtcrime.org/software/knockknock/ http://www.thoughtcrime.org/software/knockknock/
  - crdoconnor 14y ago
    Imagine how long it would take to scan every port between 1 and 65535 on millions of machines. Versus how long it would take to just try port 22 on millions of machines. It wouldn't stop a determined hacker for more than a few minutes, but it will reduce the number of automated attacks on ssh essentially to zero.
    - stinos 14y ago
      this. Everytime I check my logs there's tons of failed tries to port 22 yet none to the port ssh actually runs on. Which keeps the log with failed logins clean.
  - lotsofcows 14y ago
    They don't seem to. Plus, if they hit more than 5 ports their ip gets blocked. Plus it keeps crap out of my logs...
pbhjpbhj 14y ago
I don't understand this objection. If you've got a physical safe that you keep money or valuables in, do you put it out at the kerbside so people can have a go at cracking it, or do you hide it inside in an obscured location to make it more difficult to have a go? Surely it's the same with services on your servers, why needlessly advertise their presence. It's a tiny veneer of security but it is still more secure surely.

Another "security through obscurity" pointless trick. If I'm attacking your server and it's not running SSH on port 22, it's a very short matter of time until I've found it anyway.

tomp 14y ago

Sure. It's only meant to stop automated script-kiddie attacks that target all open SSH servers on the internet. Less logs, less disk usage, ...

drivebyacct2 14y ago
Wouldn't the script-kiddie through those hosts into a queue to run a more advanced port scan on? I mean, I see your point, but it seems highly useless compared to, say, simply disabling the password based authentication.
- lmm 14y ago
  Why would they bother? Script-kiddie is just playing the numbers, any machine with a slightly non-default configuration is not worth the effort. Disabling password authentication is better for "real" security, but doesn't stop those dictionary attacks spamming your logfile. (I still feel there should be better solutions to that problem than changing the port though)
  - drivebyacct2 14y ago
    I guess my response to all of these is... using key based auth is so much more secure than changing the port that changing the port seems to me, completely, pointless. Especially considering that: - password auth = me having to type my password everytime, likely to have a less secure password - key based auth = me never having to type it in, with a key length so long that it's completely inconceivable it'll be cracked or collided or brute forced and then when you change the port, the only "advantage" I get is that I now have to remember the port because they're already not getting in by virtue of key-based auth.
    - lenazegher 14y ago
      > using key based auth is so much more secure than changing the port Is it really? Once you get to a sensible password length (say, >14 characters) haven't you effectively made brute force and dictionary attacks impossible anyway? > password auth = me having to type my password everytime, likely to have a less secure password If you use a password often enough, I find the time difference between an 8 character and a 16 character password immeasurably small. It's all muscle memory anyway. >key based auth = me never having to type it in Perhaps I'm clinging to a false sense of security, but I find the idea of anyone with access to my local machine being able to access my server with 0 additional credentials really disconcerting. Perhaps in the theoretical world if they can access your machine it's game over anyway because they can install a keylogger. In the real world, I think there's a fairly large population of people who might access your server who wouldn't/couldn't install a keylogger to steal your password.
      - majelix 14y ago
        > but I find the idea of anyone with access to my local machine being able to access my server with 0 additional credentials really disconcerting. You could hook whatever locks your screen to also clear your ssh-agent then. This is probably something like alias xlock=$(ssh-agent -k && xlock) in linux. You do lock your screen, right?
      - jackalope 14y ago
        Your private key should have a strong passphrase. I agree that using a passphrase-less key is bad practice. As for keyloggers, once they obtain your password, they have succeeded. But after obtaining a key's passphrase (which you normally only type in once a local session if using ssh-agent), they still need the key, which may or may not be marginally harder. It's still another step to overcome. So, even if it can be shown to be only a narrow improvement over passwords under certain circumstances, it's a big win in convenience and even security under normal circumstances if done properly. Give it a try, finetune your ~/.ssh/config and you might end up loving it.
    - moe 14y ago
      The answer is really easy: You should do both. Disable password auth for root, and change the SSH port.
  - justinmk 14y ago
    > I still feel there should be better solutions to that problem than changing the port Well, there is port knocking. http://www.thoughtcrime.org/software/knockknock/ http://www.thoughtcrime.org/software/knockknock/
- crdoconnor 14y ago
  Imagine how long it would take to scan every port between 1 and 65535 on millions of machines. Versus how long it would take to just try port 22 on millions of machines. It wouldn't stop a determined hacker for more than a few minutes, but it will reduce the number of automated attacks on ssh essentially to zero.
  - stinos 14y ago
    this. Everytime I check my logs there's tons of failed tries to port 22 yet none to the port ssh actually runs on. Which keeps the log with failed logins clean.
- lotsofcows 14y ago
  They don't seem to. Plus, if they hit more than 5 ports their ip gets blocked. Plus it keeps crap out of my logs...

pbhjpbhj 14y ago

I don't understand this objection. If you've got a physical safe that you keep money or valuables in, do you put it out at the kerbside so people can have a go at cracking it, or do you hide it inside in an obscured location to make it more difficult to have a go? Surely it's the same with services on your servers, why needlessly advertise their presence. It's a tiny veneer of security but it is still more secure surely.