Hacker News Reader

Comment by Aqueous | Hacker News Reader

obscurity is not security. nothing's going to stop people from portscanning your server no matter what port it is on.

Stop trying to make it so cut-and-dry. This is not pure cryptography where the adage actually applies (a cryptographic construction should remain secure if everything about it except the key is known.)

You shouldn't mistake obscurity for security, but obscurity that doesn't actively bother the user doesn't hurt security. Again, emphasis on not mistaking obscurity for security, i.e. moving SSH to a port other than 22 does not mean that you can keep using password authentication.

Virtually all DNS servers on the Internet deny zone transfers (AXFR). This is entirely an "obscurity" measure, but it's still useful as long as people don't assume one of their hosts won't be found if it has a guessable hostname or IP address. There are many other examples.

Good rebuttal. Maybe we should start downvoting so that this truism that constantly gets trotted out can go away.

On the other hand, your explanation plus the other replies probably help people dispel this notion for others, so maybe it's good to keep this kind of thing coming around.

It gets trotted out for a reason - because it is true.

All the change of port does is reduce the load avg from brute force attacks and failed connection attempts. You can accomplish the same thing with a fail2ban rule on the standard port.

Changing the port doesn't prevent intrusions. That's not a security benefit. That's a performance benefit, and a short-lived one at that, since what do you think botnet hackers will do once they've figured out that we're all running SSHd on a non-standard port and their brute force success rate goes to zero? They're going to adapt to the situation and scan the machine before connecting to it.

It's not security if it doesn't give a guarantee. Changing the port guarantees nothing.

You're right that it doesn't prevent intrusions from someone who's focusing on your machine, but doing something unusual that requires extra steps of attackers does usually decrease the likelihood of intrusions, especially from automated means. You're acting like bots frequently portscan when trying to brute force ssh, and I can tell you that they generally don't.

I typically don't bother, and just use fail2ban, but it's silly to say that it doesn't make it more secure. It does, if only marginally. As long as people are aware that it isn't sufficient, and that they still need to use strong passwords and/or public key auth, then there's no problem with saying that this makes things more secure.

I don't see what moving it to 2222 does that turning off password authentication, requiring public key authentication disallowing remote root login, and fail2banning repeated login attempts doesn't.. Is there a vulnerability in SSH or our asymmetric key cryptography that I don't know about(other than the one possibly introduced to the random number generator)? If there is, is the NSA less likely to use 2222 to knock on our door than 22? The only thing - the only thing - that moving it to 2222 does is reduce load avg due to brute force botnet attacks. And banning ips after 3 failed connection attempts should have a similar effect on the load avg. That is the only benefit. If you ask me that benefit isn't enough for me to give up the time spent typing -p 2222 every time i run the ssh command.

Even if that's the only thing, that's not useless. Just don't mistake it for a security measure.

Also, you can put port numbers in your SSH config, so you never have to type them.

I move from computer to computer a lot and don't take my SSH config with me. Typing the extra -p 2222 is tedious when it doesn't give me any benefit.

The only thing moving the SSH daemon does is give us a slight, conditional performance benefit (that using fail2ban on port 22 also gives, along with an actual security benefit). It does not give us any security benefit at all.

I like to run hardened SSH servers - key only authentication and specific lists of permitted users. From a security point of view this works on the default port or an alternate port. Root is blocked from logging in directly.

Having SSH moved to an alternate port helps mitigate the load caused by continuous SSH worm connections. Having the firewall additionally block SSH except from pre-approved adds additional defense, but adds the complexity that the admin cannot login from his mobile phone using just SSH without first adding his current temporary IP address to the firewall.

The alternate port, is not by itself a security mechanism but it can help in real life deployments.

It is a good article and raises really good points. I have bookmarked it because I do want to experiment with the author's iptables example.

Moving to a different port keeps the server logs a lot cleaner, making real attacks easier to spot.

Moving ssh to a different port and using something like port-sentry could make it much harder. It will not increase your security per se, but it can make you less vulnerable to zero day exploits against random general internet scans.

What percentage of attackers port scan a broad range of ports vs. just trying port 22?

I have not measured it in a long time, but the effect of blocking port 22 and leaving open a non-standard SSH port is dramatic! As in noticeable decrease in load average on the server.

Yeah, its not about increasing security against an individual but pretending to be a less appealing target to the masses.

Ah but what about Port Knocking?

http://en.wikipedia.org/wiki/Port_knocking

Reply on news.ycombinator.com