4 ms·
They just need to scan once to find the port speaking SSH, then brute force as usual. If you want actual more protection run a bogus SSH (with no login allowed
by bsdetector 13y ago
They just need to scan once to find the port speaking SSH, then brute force as usual.
If you want actual more protection run a bogus SSH (with no login allowed) on 22 and a thousand unused ports... then they have to try them all or guess which port is actually able to log in.
- monkeyspaw 13y agoOTOH, not running on port 22 prevents you from drive by scans. You are right that it doesn't protect from a targeted attack. In my experience (10 years as a sysadmin and dev), I've never had a targeted attack -- all the attempts against my machines are drive by. Having port 22 open can end my IPs on a list of "let's try to break later". It's not close to a complete solution, but I find it beneficial.