3 ms·

If you are running the server and your server is compromised than the attacker can remove the ssh server you are running and put up his own malicious program to

by theboss 13y ago

If you are running the server and your server is compromised than the attacker can remove the ssh server you are running and put up his own malicious program to collect your password if and only if they port is above 1024, and they don't need root privileges, they can have www-data privileges or whatever

Volundr 13y ago
Again if he can remove ssh running as root on port 1xxxx, he can run his ssh-alike on port 22.
- theboss 13y ago
  but he can do 1xxx from an unprivileged NOT ROOT and he requires root to do that with port 22, again
  - Volundr 13y ago
    So basically, he's gained root once to kill ssh running as root, but you think that gaining root again in order to run something on port 22 is what's going to stop him?