Hacker News new | past | comments | ask | show | jobs | submit login

Not entirely true. Moving your SSH port will not prevent a targeted attacker from finding it, it'll barely slow them down.

What it will do however is prevent automated script-kiddy scanning tools from seeing port 22 open, scraping the banner, and adding your IP to a list of target to brute force/exploit. That's a good thing, and is absolutely, by any definition, a security benefit.




Automated tools already won't get into your machine if you disable passwords. And they can easily adapt to non standard ports if the authors see any worth in doing that.

Setting a non-standard port to ssh is akin to adding a wood plank to the door of a safe with state of the art locks and 20" steel walls. A very annoying wood plank, by the way.


No it's like hiding the safe so that 99.99% of attackers don't know you have it and break into your neighbors instead.


No, it's like hiding your cash under your mattress expecting people not to look there.

Real security doesn't rely on obscurity.


Wrong. That's how NOT to set up SSH. Use keys and / or log scanning to auto firewall failed login attempts. I recommend fail2ban, but there's a few daemons that do the same thing.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: