Obscurity: Does Changing Your SSH Port Lower Your Risk?

Re:Obscurity: Does Changing Your SSH Port Lower Your Risk? by petercooper on Friday February 18, 2011 @12:53PM (#2236448)

Even if it didn't, it lowers the number of log entries, failed attempts, and number of connections by several orders of magnitude. I've never regretted doing it though I pick a far more obscure port than this. None of my clients have had issues with me doing this either and sshagent makes it transparent to me.

It's the equivalent of moving your main door to the back of your house. Far fewer people will knock, even though burglars can still get in.

[ Parent | on HN ]

Re:Obscurity: Does Changing Your SSH Port Lower Your Risk? by dspillett on Friday February 18, 2011 @01:23PM (#2236574)

For the log file issue I usually recommend using something like fail2ban to start blocking hosts after too many failed logins in a given time period (and unblock them after a while).

If you are running a shared environment the irritation of the log entries (or needing to run something like fail2ban or similar if you don't already) may be small compared to having to explain to your users again and again and again that the reason their SSH/SCP/SFTP client won't connect is that they need to tell it to use a different port (and then have to work out how to set a different port in the client they are using because they'll expect you to know).

[ Parent | on HN ]

Re:Obscurity: Does Changing Your SSH Port Lower Your Risk? by gnosis on Friday February 18, 2011 @04:32PM (#2237357)

The problem with fail2ban is that it's vulnerable to denial of service attacks when the attacker spoofs the source IP address of the failed login attempts.

[ Parent | on HN ]

Re:Obscurity: Does Changing Your SSH Port Lower Your Risk? by devicenull on Saturday February 19, 2011 @11:03AM (#2239224)

How do you spoof TCP connections?

[ Parent | on HN ]

Re:Obscurity: Does Changing Your SSH Port Lower Your Risk? by gnosis on Saturday February 19, 2011 @12:39PM (#2239426)

http://lmgtfy.com/?q=tcp+connection+spoofing

[ Parent | on HN ]

Re:Obscurity: Does Changing Your SSH Port Lower Your Risk? by devicenull on Tuesday February 22, 2011 @08:01PM (#2252449)

I'd be amazed if you could show me a TCP spoofing attack that works against a remote host (that you aren't on the same LAN as).

As far as I know (and google shows), they don't exist.

[ Parent | on HN ]

Re:Obscurity: Does Changing Your SSH Port Lower Your Risk? by notyourwork on Friday February 18, 2011 @01:26PM (#2236584)

Glad you mentioned choosing a obscure port. Not that 24 is wrong though <1024 are reserved for various protocols so usually I tend to select ports above this reserved range. Never know when you decide to roll out say mail on 25 and sure enough find out your ssh port is running on 25.

[ Parent | on HN ]

Re:Obscurity: Does Changing Your SSH Port Lower Your Risk? by kijinbear on Friday February 18, 2011 @02:55PM (#2236961)

Any port not listed in the link below, or listed as "Unassigned", would be fair game.

http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_number...

[ Parent | on HN ]

Re:Obscurity: Does Changing Your SSH Port Lower Your Risk? by LordLandon on Friday February 18, 2011 @04:29PM (#2237350)

If you're running a multi-user server, with possibly malicious users, that's not a good idea. Ports <1024 can only be bound to by root; so if a valid user of the server can figure out how to crash sshd, he can run his own version on the same port >1024, and then all your users' password are belong to him.

[ Parent | on HN ]

Re:Obscurity: Does Changing Your SSH Port Lower Your Risk? by petercooper on Friday February 18, 2011 @06:24PM (#2237722)

When I read your comment, I thought "surely you couldn't rig up a fake sshd to steal passwords" thinking the protocol wouldn't send passwords in plaintext but instead some hashing would take place. I read the RFC and, wow, it does send plaintext (though it's over an encrypted transport). Ouch..

[ Parent | on HN ]

Re:Obscurity: Does Changing Your SSH Port Lower Your Risk? by ryanpetrich on Friday February 18, 2011 @06:37PM (#2237758)

Any client that has the server's public key in their known_hosts will throw up a big fat error.

[ Parent | on HN ]

Re:Obscurity: Does Changing Your SSH Port Lower Your Risk? by jluxenberg on Friday February 18, 2011 @11:27PM (#2238376)

This is mitigated by not allowing password-based logins for SSH. Your point still stands though.

[ Parent | on HN ]

Re:Obscurity: Does Changing Your SSH Port Lower Your Risk? by pentarim on Friday February 18, 2011 @01:37PM (#2236623)

This. Plus installed knockd (http://www.zeroflux.org/projects/knock) of course :)

[ Parent | on HN ]

Re:Obscurity: Does Changing Your SSH Port Lower Your Risk? by getsat on Friday February 18, 2011 @02:53PM (#2236955)

Check this out: http://www.google.com/search?q=single+packet+authorization

[ Parent | on HN ]

Re:Obscurity: Does Changing Your SSH Port Lower Your Risk? by oreilly on Saturday February 19, 2011 @12:45AM (#2238522)

Anyone got this to work? My attempt ended up with an encrypted packet size over the 1500 byte limit.

[ Parent | on HN ]