Obscurity: Does Changing Your SSH Port Lower Your Risk?

Re:Obscurity: Does Changing Your SSH Port Lower Your Risk? by dspillett on Friday February 18, 2011 @01:23PM (#2236574)

For the log file issue I usually recommend using something like fail2ban to start blocking hosts after too many failed logins in a given time period (and unblock them after a while).

If you are running a shared environment the irritation of the log entries (or needing to run something like fail2ban or similar if you don't already) may be small compared to having to explain to your users again and again and again that the reason their SSH/SCP/SFTP client won't connect is that they need to tell it to use a different port (and then have to work out how to set a different port in the client they are using because they'll expect you to know).

[ Parent | on HN ]

Re:Obscurity: Does Changing Your SSH Port Lower Your Risk? by gnosis on Friday February 18, 2011 @04:32PM (#2237357)

The problem with fail2ban is that it's vulnerable to denial of service attacks when the attacker spoofs the source IP address of the failed login attempts.

[ Parent | on HN ]

Re:Obscurity: Does Changing Your SSH Port Lower Your Risk? by devicenull on Saturday February 19, 2011 @11:03AM (#2239224)

How do you spoof TCP connections?

[ Parent | on HN ]

Re:Obscurity: Does Changing Your SSH Port Lower Your Risk? by gnosis on Saturday February 19, 2011 @12:39PM (#2239426)

http://lmgtfy.com/?q=tcp+connection+spoofing

[ Parent | on HN ]

Re:Obscurity: Does Changing Your SSH Port Lower Your Risk? by devicenull on Tuesday February 22, 2011 @08:01PM (#2252449)

I'd be amazed if you could show me a TCP spoofing attack that works against a remote host (that you aren't on the same LAN as).

As far as I know (and google shows), they don't exist.

[ Parent | on HN ]