Re:Obscurity: Does Changing Your SSH Port Lower Your Risk?
by notyourwork on Friday February 18, 2011 @01:26PM
(#2236584)
Glad you mentioned choosing a obscure port. Not that 24 is wrong though <1024 are reserved for various protocols so usually I tend to select ports above this reserved range. Never know when you decide to roll out say mail on 25 and sure enough find out your ssh port is running on 25.
[ Parent
| on HN ]
Re:Obscurity: Does Changing Your SSH Port Lower Your Risk?
by kijinbear on Friday February 18, 2011 @02:55PM
(#2236961)
Any port not listed in the link below, or listed as "Unassigned", would be fair game.
http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_number...
Re:Obscurity: Does Changing Your SSH Port Lower Your Risk?
by LordLandon on Friday February 18, 2011 @04:29PM
(#2237350)
If you're running a multi-user server, with possibly malicious users, that's not a good idea. Ports <1024 can only be bound to by root; so if a valid user of the server can figure out how to crash sshd, he can run his own version on the same port >1024, and then all your users' password are belong to him.
Re:Obscurity: Does Changing Your SSH Port Lower Your Risk?
by petercooper on Friday February 18, 2011 @06:24PM
(#2237722)
When I read your comment, I thought "surely you couldn't rig up a fake sshd to steal passwords" thinking the protocol wouldn't send passwords in plaintext but instead some hashing would take place. I read the RFC and, wow, it does send plaintext (though it's over an encrypted transport). Ouch..
Re:Obscurity: Does Changing Your SSH Port Lower Your Risk?
by ryanpetrich on Friday February 18, 2011 @06:37PM
(#2237758)
Any client that has the server's public key in their known_hosts will throw up a big fat error.
Re:Obscurity: Does Changing Your SSH Port Lower Your Risk?
by jluxenberg on Friday February 18, 2011 @11:27PM
(#2238376)
This is mitigated by not allowing password-based logins for SSH. Your point still stands though.