documentation, so that when you’re hit by a bus the poor sap who takes over for you can figure out what the hell you changed,.testing, as every change to every ancillary system that connects to your hidden SSH will need to be tested to make sure it still works after every patch,.maintenance, in that you need to keep the SSH configuration up to date, along with all the other stuff that connects to it,.education, because absolutely everybody & everything assumes that SSH is on port 22,.Everything you change away from the defaults requires: Complexity isn’t good - it drives up costs. I contend that by making this type of change you’re making the system more complex. “Why are you complaining? At worst it’s no better than the default, and maybe it’ll work.” The sneaky port moves took about 10 seconds to defeat, and that’s if the attacker is a moron. There is something weird on port 10000… Maybe I’ll telnet to it and see what it does!” Of course, upon telnetting to it OpenSSH tells them it’s OpenSSH. Hacker: “Hmm, looks like a Linux mail server, but there’s no SSH. Nmap done: 1 IP address (1 host up) scanned in 1.92 seconds OS CPE: cpe:/o:linux:kernel:2.6 cpe:/o:linux:kernel:3 Other addresses for localhost (not scanned): 127.0.0.1 Nmap scan report for localhost (127.0.0.1)

“Oh yeah, how will they know to look for port 10000?” someone might ask. My second argument is that if you connect to OpenSSH, no matter what port, it tells you it’s OpenSSH: $ telnet localhost 10000 That’s sort of like my argument to my wife about wearing wedding rings: if that’s the only thing keeping us faithful to each other then we’ve got problems. It is, at best, a secondary measure and disclosure of the obscurity should not result in a compromise. There is a general consensus, even among those who argue in favor of security through obscurity, that security through obscurity should never be used as a primary security measure. …it can be argued that a sufficiently well-implemented system based on security through obscurity simply becomes another variant on a key-based scheme, with the obscure details of the system acting as the secret key value. Even the end of the pro-obscurity section concedes: The Wikipedia article on security through obscurity has a section called “Arguments For” which reads more like an apologist’s version of the “Arguments against” section. Unfortunately some programs use port 22 by default and it isn’t obvious what the switch is to change this port.įirst, whose best practices say this? Some self-appointed security expert on the web? I ask because this sort of activity is known as “security through obscurity” and isn’t regarded well as a security tactic. The post starts out like this:īest practices state that you should run ssh on an non-standard port. It was about the effects of moving SSH to an alternate port. There’s a post I read the other day that’s really been stuck in my craw (link is below).

Openssh port