Hacker News Reader

Comment by craftinator | Hacker News Reader

So... Are you saying that moving your ssh port to a different address doesn't actually increase your security at all? In my practice it gets rid of ~95% of probes from people trying to break into my system. Whether it just signals that I know what I'm doing, or demands resources that the attackers aren't willing to give, I don't know, but it definitely has a positive effect on the security of my system.

View on HN

>So... Are you saying that moving your ssh port to a different address doesn't actually increase your security at all

No I think if you read particularly the "Why all the hate..." paragraph you'll see I'm saying the opposite of that. There is nothing wrong with obscurity but in terms of security its the icing not the cake.

By that I mean it will make a secure setup more secure, but its not enough on its own.

>So... Are you saying that moving your ssh port to a different address doesn't actually increase your security at all?

Having a quagmire next to your castle walls don't makes your walls harder to breach, just buys you more time until the enemy gets there.

It's not bad thing to have, but ... just don't build your walls lower and thinner next to the swamp.

Aren't most SSH probes trying to break weak passwords? If so, having a strong password is much much more important than the port SSH is on.

Really, you should not be using passwords at all. We have key-based authentication for a reason.

Totally agree.

Walk and chew gum.

He's saying that it doesn't make your SSH configuration or SSH itself any more secure.

Building a house and putting the front door on the side or back of the house doesn't change the security of the door. Whether it has a weak lock or not doesn't depend on its location.

it doesn't increase the security at all, but is really convenient as you filter most of automatic attacks and have much less noise to filter through.

Would banning any IP that tries connecting on 22 increase security?

how do you connect rightfully then? at that point is easier to have and access rule on the firewall and only accept connections from the allowed ips.

You could do something like that, but you'd have to write it yourself. If you want to ban IP addresses, fail2ban is probably an easier starting point. Plus users who authenticate with passwords might occasionally make typos and get banned, incentivizing better logon techniques.

For my random high numbered IP ssh port, I see 5-15 attempts per day. In the last 3 months, the most failed attempts from a single IP is 3. Most attackers (at least amongst those that try higher ports) are distributed these days.

Reply on news.ycombinator.com