5 ms·

Stop trying to make it so cut-and-dry. This is not pure cryptography where the adage actually applies (a cryptographic construction should remain secure if ever

Stop trying to make it so cut-and-dry. This is not pure cryptography where the adage actually applies (a cryptographic construction should remain secure if everything about it except the key is known.) You shouldn't mistake obscurity for security, but obscurity that doesn't actively bother the user doesn't hurt security. Again, emphasis on not mistaking obscurity for security, i.e. moving SSH to a port other than 22 does not mean that you can keep using password authentication. Virtually all DNS servers on the Internet deny zone transfers (AXFR). This is entirely an "obscurity" measure, but it's still useful as long as people don't assume one of their hosts won't be found if it has a guessable hostname or IP address. There are many other examples.

ericd 13y ago
Good rebuttal. Maybe we should start downvoting so that this truism that constantly gets trotted out can go away. On the other hand, your explanation plus the other replies probably help people dispel this notion for others, so maybe it's good to keep this kind of thing coming around.
- Aqueous 13y ago
  It gets trotted out for a reason - because it is true. All the change of port does is reduce the load avg from brute force attacks and failed connection attempts. You can accomplish the same thing with a fail2ban rule on the standard port. Changing the port doesn't prevent intrusions. That's not a security benefit. That's a performance benefit, and a short-lived one at that, since what do you think botnet hackers will do once they've figured out that we're all running SSHd on a non-standard port and their brute force success rate goes to zero? They're going to adapt to the situation and scan the machine before connecting to it. It's not security if it doesn't give a guarantee. Changing the port guarantees nothing.
  - ericd 13y ago
    You're right that it doesn't prevent intrusions from someone who's focusing on your machine, but doing something unusual that requires extra steps of attackers does usually decrease the likelihood of intrusions, especially from automated means. You're acting like bots frequently portscan when trying to brute force ssh, and I can tell you that they generally don't. I typically don't bother, and just use fail2ban, but it's silly to say that it doesn't make it more secure. It does, if only marginally. As long as people are aware that it isn't sufficient, and that they still need to use strong passwords and/or public key auth, then there's no problem with saying that this makes things more secure.
Aqueous 13y ago
I don't see what moving it to 2222 does that turning off password authentication, requiring public key authentication disallowing remote root login, and fail2banning repeated login attempts doesn't.. Is there a vulnerability in SSH or our asymmetric key cryptography that I don't know about(other than the one possibly introduced to the random number generator)? If there is, is the NSA less likely to use 2222 to knock on our door than 22? The only thing - the only thing - that moving it to 2222 does is reduce load avg due to brute force botnet attacks. And banning ips after 3 failed connection attempts should have a similar effect on the load avg. That is the only benefit. If you ask me that benefit isn't enough for me to give up the time spent typing -p 2222 every time i run the ssh command.
- thirsteh 13y ago
  Even if that's the only thing, that's not useless. Just don't mistake it for a security measure. Also, you can put port numbers in your SSH config, so you never have to type them.
  - Aqueous 13y ago
    I move from computer to computer a lot and don't take my SSH config with me. Typing the extra -p 2222 is tedious when it doesn't give me any benefit. The only thing moving the SSH daemon does is give us a slight, conditional performance benefit (that using fail2ban on port 22 also gives, along with an actual security benefit). It does not give us any security benefit at all.

ericd 13y ago

Good rebuttal. Maybe we should start downvoting so that this truism that constantly gets trotted out can go away. On the other hand, your explanation plus the other replies probably help people dispel this notion for others, so maybe it's good to keep this kind of thing coming around.

Aqueous 13y ago
It gets trotted out for a reason - because it is true. All the change of port does is reduce the load avg from brute force attacks and failed connection attempts. You can accomplish the same thing with a fail2ban rule on the standard port. Changing the port doesn't prevent intrusions. That's not a security benefit. That's a performance benefit, and a short-lived one at that, since what do you think botnet hackers will do once they've figured out that we're all running SSHd on a non-standard port and their brute force success rate goes to zero? They're going to adapt to the situation and scan the machine before connecting to it. It's not security if it doesn't give a guarantee. Changing the port guarantees nothing.
- ericd 13y ago
  You're right that it doesn't prevent intrusions from someone who's focusing on your machine, but doing something unusual that requires extra steps of attackers does usually decrease the likelihood of intrusions, especially from automated means. You're acting like bots frequently portscan when trying to brute force ssh, and I can tell you that they generally don't. I typically don't bother, and just use fail2ban, but it's silly to say that it doesn't make it more secure. It does, if only marginally. As long as people are aware that it isn't sufficient, and that they still need to use strong passwords and/or public key auth, then there's no problem with saying that this makes things more secure.

Aqueous 13y ago

I don't see what moving it to 2222 does that turning off password authentication, requiring public key authentication disallowing remote root login, and fail2banning repeated login attempts doesn't.. Is there a vulnerability in SSH or our asymmetric key cryptography that I don't know about(other than the one possibly introduced to the random number generator)? If there is, is the NSA less likely to use 2222 to knock on our door than 22? The only thing - the only thing - that moving it to 2222 does is reduce load avg due to brute force botnet attacks. And banning ips after 3 failed connection attempts should have a similar effect on the load avg. That is the only benefit. If you ask me that benefit isn't enough for me to give up the time spent typing -p 2222 every time i run the ssh command.

thirsteh 13y ago
Even if that's the only thing, that's not useless. Just don't mistake it for a security measure. Also, you can put port numbers in your SSH config, so you never have to type them.
- Aqueous 13y ago
  I move from computer to computer a lot and don't take my SSH config with me. Typing the extra -p 2222 is tedious when it doesn't give me any benefit. The only thing moving the SSH daemon does is give us a slight, conditional performance benefit (that using fail2ban on port 22 also gives, along with an actual security benefit). It does not give us any security benefit at all.