Hacker News Reader

Comment by samuel | Hacker News Reader

When I ran OpenBSD I used to block on repeated failed attempts(see: http://home.nuug.no/~peter/pf/en/long-firewall.html#BRUTEFOR...).

I used to change ssh's port, but not anymore. If a bruteforce attack is a threat to you, then you are better being compromised by a random script kiddie or spammer than by a targeted attacker looking after your data. Take that scans as free, low skilled, penetration tests.

View on HN

A nonstandard port removes a crazy amount of login attempts though for something as simple as adding:

    Host example.com
        Port #####

to your ~/.ssh/config

Alternately, adding those lines to every single host you control is one hell of an annoyance for something that doesn't stop any sort of real attack on your server. It's trivial for a real attacker to find your sshd running on any port.

Well sure it could be bad if you are using 10 computers or you have 10 different servers to login to, but personally I have 2 computers that I use and only manage a few servers so it isn't all that bad, plus the config file is linked to dropbox for me.

Besides it is more like a one time annoyance unless you are one of those crazy people that formats without backups every month.

Yes, this is true - it's not going to stop someone who really wants in from finding your SSH port. But at the very least, it's useful when looking through your logs, because the ONLY failed log in attempts you will see are from people who mean business.

Reply on news.ycombinator.com