4 ms·

> If you are, then the author is 100% correct that it is not a good idea to run a SSH server above port 1024, or any port other than 22. Ok, but you haven't ex

> If you are, then the author is 100% correct that it is not a good idea to run a SSH server above port 1024, or any port other than 22. Ok, but you haven't explained why. The author's stated claim is that running an SSH server over 1024 means the connecting party cannot trust the server, but that of course doesn't apply if you are running the server. If you want to truly secure your server, then yeah, changing the port doesn't really do much but there are some minor benefits (see other responses in this thread, and on the internet). I'm still not seeing the harm.

theboss 13y ago
If you are running the server and your server is compromised than the attacker can remove the ssh server you are running and put up his own malicious program to collect your password if and only if they port is above 1024, and they don't need root privileges, they can have www-data privileges or whatever
- Volundr 13y ago
  Again if he can remove ssh running as root on port 1xxxx, he can run his ssh-alike on port 22.
  - theboss 13y ago
    but he can do 1xxx from an unprivileged NOT ROOT and he requires root to do that with port 22, again
    - Volundr 13y ago
      So basically, he's gained root once to kill ssh running as root, but you think that gaining root again in order to run something on port 22 is what's going to stop him?
Volundr 13y ago
Put another way, if someone has gained access to run a script as a non-root user on my server, and somehow managed to kill SSH which is running as root to bind to that port, gained access to my host key (which should only be readable by root), so that my ssh client won't warn me when I connect, and is now running an ssh-alike on that port, I'm pretty well owned already. It's hard to see how someone with this much access doesn't have enough to go ahead an run their ssh-alike on port 22. That said, I run ssh on a non-standard port for one reason only, it's a crap-load easier to check the log files for suspicious activity that way. I still run use the same protections I do for servers with ssh on 22.

theboss 13y ago

If you are running the server and your server is compromised than the attacker can remove the ssh server you are running and put up his own malicious program to collect your password if and only if they port is above 1024, and they don't need root privileges, they can have www-data privileges or whatever

Volundr 13y ago
Again if he can remove ssh running as root on port 1xxxx, he can run his ssh-alike on port 22.
- theboss 13y ago
  but he can do 1xxx from an unprivileged NOT ROOT and he requires root to do that with port 22, again
  - Volundr 13y ago
    So basically, he's gained root once to kill ssh running as root, but you think that gaining root again in order to run something on port 22 is what's going to stop him?

Volundr 13y ago

Put another way, if someone has gained access to run a script as a non-root user on my server, and somehow managed to kill SSH which is running as root to bind to that port, gained access to my host key (which should only be readable by root), so that my ssh client won't warn me when I connect, and is now running an ssh-alike on that port, I'm pretty well owned already. It's hard to see how someone with this much access doesn't have enough to go ahead an run their ssh-alike on port 22. That said, I run ssh on a non-standard port for one reason only, it's a crap-load easier to check the log files for suspicious activity that way. I still run use the same protections I do for servers with ssh on 22.