Hacker News Reader

Glad you mentioned choosing a obscure port. Not that 24 is wrong though <1024 are reserved for various protocols so usually I tend to select ports above this reserved range. Never know when you decide to roll out say mail on 25 and sure enough find out your ssh port is running on 25.

View on HN

Any port not listed in the link below, or listed as "Unassigned", would be fair game.

http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_number...

If you're running a multi-user server, with possibly malicious users, that's not a good idea. Ports <1024 can only be bound to by root; so if a valid user of the server can figure out how to crash sshd, he can run his own version on the same port >1024, and then all your users' password are belong to him.

When I read your comment, I thought "surely you couldn't rig up a fake sshd to steal passwords" thinking the protocol wouldn't send passwords in plaintext but instead some hashing would take place. I read the RFC and, wow, it does send plaintext (though it's over an encrypted transport). Ouch..

Any client that has the server's public key in their known_hosts will throw up a big fat error.

This is mitigated by not allowing password-based logins for SSH. Your point still stands though.

Reply on news.ycombinator.com