4 ms·

obscurity is not security. nothing's going to stop people from portscanning your server no matter what port it is on.

• gabemart 13y ago
  What percentage of attackers port scan a broad range of ports vs. just trying port 22?
  • rietta 13y ago
    I have not measured it in a long time, but the effect of blocking port 22 and leaving open a non-standard SSH port is dramatic! As in noticeable decrease in load average on the server.
• encno1s3 13y ago
  Moving ssh to a different port and using something like port-sentry could make it much harder. It will not increase your security per se, but it can make you less vulnerable to zero day exploits against random general internet scans.
• platz 13y ago
  Yeah, its not about increasing security against an individual but pretending to be a less appealing target to the masses.
• markrages 13y ago
  Moving to a different port keeps the server logs a lot cleaner, making real attacks easier to spot.
• rietta 13y ago
  I like to run hardened SSH servers - key only authentication and specific lists of permitted users. From a security point of view this works on the default port or an alternate port. Root is blocked from logging in directly. Having SSH moved to an alternate port helps mitigate the load caused by continuous SSH worm connections. Having the firewall additionally block SSH except from pre-approved adds additional defense, but adds the complexity that the admin cannot login from his mobile phone using just SSH without first adding his current temporary IP address to the firewall. The alternate port, is not by itself a security mechanism but it can help in real life deployments. It is a good article and raises really good points. I have bookmarked it because I do want to experiment with the author's iptables example.
• thirsteh 13y ago
  Stop trying to make it so cut-and-dry. This is not pure cryptography where the adage actually applies (a cryptographic construction should remain secure if everything about it except the key is known.) You shouldn't mistake obscurity for security, but obscurity that doesn't actively bother the user doesn't hurt security. Again, emphasis on not mistaking obscurity for security, i.e. moving SSH to a port other than 22 does not mean that you can keep using password authentication. Virtually all DNS servers on the Internet deny zone transfers (AXFR). This is entirely an "obscurity" measure, but it's still useful as long as people don't assume one of their hosts won't be found if it has a guessable hostname or IP address. There are many other examples.
  • ericd 13y ago
    Good rebuttal. Maybe we should start downvoting so that this truism that constantly gets trotted out can go away. On the other hand, your explanation plus the other replies probably help people dispel this notion for others, so maybe it's good to keep this kind of thing coming around.
    • Aqueous 13y ago
      It gets trotted out for a reason - because it is true. All the change of port does is reduce the load avg from brute force attacks and failed connection attempts. You can accomplish the same thing with a fail2ban rule on the standard port. Changing the port doesn't prevent intrusions. That's not a security benefit. That's a performance benefit, and a short-lived one at that, since what do you think botnet hackers will do once they've figured out that we're all running SSHd on a non-standard port and their brute force success rate goes to zero? They're going to adapt to the situation and scan the machine before connecting to it. It's not security if it doesn't give a guarantee. Changing the port guarantees nothing.
      • ericd 13y ago
        You're right that it doesn't prevent intrusions from someone who's focusing on your machine, but doing something unusual that requires extra steps of attackers does usually decrease the likelihood of intrusions, especially from automated means. You're acting like bots frequently portscan when trying to brute force ssh, and I can tell you that they generally don't. I typically don't bother, and just use fail2ban, but it's silly to say that it doesn't make it more secure. It does, if only marginally. As long as people are aware that it isn't sufficient, and that they still need to use strong passwords and/or public key auth, then there's no problem with saying that this makes things more secure.
• ninetax 13y ago
  Ah but what about Port Knocking? http://en.wikipedia.org/wiki/Port_knocking http://en.wikipedia.org/wiki/Port_knocking