3 ms·

If you don't trust the other side, you aren't administering the server, in which case this article isn't written for you. If you are, then the author is 100% c

by theboss 13y ago

If you don't trust the other side, you aren't administering the server, in which case this article isn't written for you. If you are, then the author is 100% correct that it is not a good idea to run a SSH server above port 1024, or any port other than 22. There are much better solutions to dealing with drive-by attempted logins, and some of them are built into ssh.

vacri 13y ago
There are plenty of unassigned ports below 1024 that you could happily use without theoretically stepping on toes, why not use one of them? Further down the page there are several people stating tangible benefits for moving off port 22.
- theboss 13y ago
  I said above 1024 and picking on other than 22 is just Security Through Obscurity. I can banner grab you in less than a second and figure out which port is running an ssh server. If you really want to then go for it. But above 1024 is a no go.
jaequery 13y ago
What OP points out is good for starters but If you were really serious about security, you'd be locking your servers behind VPN and 2 factor auths. Cloudpassage.com does a pretty good job for locking down your servers for truly serious.
nairteashop 13y ago
> If you are, then the author is 100% correct that it is not a good idea to run a SSH server above port 1024, or any port other than 22. Ok, but you haven't explained why. The author's stated claim is that running an SSH server over 1024 means the connecting party cannot trust the server, but that of course doesn't apply if you are running the server. If you want to truly secure your server, then yeah, changing the port doesn't really do much but there are some minor benefits (see other responses in this thread, and on the internet). I'm still not seeing the harm.
- theboss 13y ago
  If you are running the server and your server is compromised than the attacker can remove the ssh server you are running and put up his own malicious program to collect your password if and only if they port is above 1024, and they don't need root privileges, they can have www-data privileges or whatever
  - Volundr 13y ago
    Again if he can remove ssh running as root on port 1xxxx, he can run his ssh-alike on port 22.
    - theboss 13y ago
      but he can do 1xxx from an unprivileged NOT ROOT and he requires root to do that with port 22, again
      - Volundr 13y ago
        So basically, he's gained root once to kill ssh running as root, but you think that gaining root again in order to run something on port 22 is what's going to stop him?
- Volundr 13y ago
  Put another way, if someone has gained access to run a script as a non-root user on my server, and somehow managed to kill SSH which is running as root to bind to that port, gained access to my host key (which should only be readable by root), so that my ssh client won't warn me when I connect, and is now running an ssh-alike on that port, I'm pretty well owned already. It's hard to see how someone with this much access doesn't have enough to go ahead an run their ssh-alike on port 22. That said, I run ssh on a non-standard port for one reason only, it's a crap-load easier to check the log files for suspicious activity that way. I still run use the same protections I do for servers with ssh on 22.

by theboss 13y ago

vacri 13y ago

There are plenty of unassigned ports below 1024 that you could happily use without theoretically stepping on toes, why not use one of them? Further down the page there are several people stating tangible benefits for moving off port 22.

theboss 13y ago
I said above 1024 and picking on other than 22 is just Security Through Obscurity. I can banner grab you in less than a second and figure out which port is running an ssh server. If you really want to then go for it. But above 1024 is a no go.

jaequery 13y ago

What OP points out is good for starters but If you were really serious about security, you'd be locking your servers behind VPN and 2 factor auths. Cloudpassage.com does a pretty good job for locking down your servers for truly serious.

nairteashop 13y ago

> If you are, then the author is 100% correct that it is not a good idea to run a SSH server above port 1024, or any port other than 22. Ok, but you haven't explained why. The author's stated claim is that running an SSH server over 1024 means the connecting party cannot trust the server, but that of course doesn't apply if you are running the server. If you want to truly secure your server, then yeah, changing the port doesn't really do much but there are some minor benefits (see other responses in this thread, and on the internet). I'm still not seeing the harm.

theboss 13y ago
If you are running the server and your server is compromised than the attacker can remove the ssh server you are running and put up his own malicious program to collect your password if and only if they port is above 1024, and they don't need root privileges, they can have www-data privileges or whatever
- Volundr 13y ago
  Again if he can remove ssh running as root on port 1xxxx, he can run his ssh-alike on port 22.
  - theboss 13y ago
    but he can do 1xxx from an unprivileged NOT ROOT and he requires root to do that with port 22, again
    - Volundr 13y ago
      So basically, he's gained root once to kill ssh running as root, but you think that gaining root again in order to run something on port 22 is what's going to stop him?
Volundr 13y ago
Put another way, if someone has gained access to run a script as a non-root user on my server, and somehow managed to kill SSH which is running as root to bind to that port, gained access to my host key (which should only be readable by root), so that my ssh client won't warn me when I connect, and is now running an ssh-alike on that port, I'm pretty well owned already. It's hard to see how someone with this much access doesn't have enough to go ahead an run their ssh-alike on port 22. That said, I run ssh on a non-standard port for one reason only, it's a crap-load easier to check the log files for suspicious activity that way. I still run use the same protections I do for servers with ssh on 22.