Hacker News Reader

I'm not using the default port on one machine, but I do on the other. With key based login, is it really necessary?

If you don't run ssh on port 22, it's been proved that it receives a lot less outside login attempts and stops the logs filling up with login failures apart from anything else.

Logs filling up with login failures is hardly a decent reason.

Two reasons: 1. Logs filling up with login failures from drive-bys masks legitimate/focused hack attempts. 2. If there's a security vulnerability found for sshd, non-standard port choice reduces the risk of drive-by scanners.

Non-standard ports don't stop dedicated attacks, but they do reduce noise that can obfuscate a dedicated attack and can reduce your exposure to uncommitted attackers.

If there's ever a TCP-based attack against the server, the non-standard port reduces the risk a little bit.

The risk reduction is negligible if someone is doing a portscan on your host. Connection attempts to non standard ports will eventually occur. The better solution is to use single packet authorization.[1]

1. http://cipherdyne.org/fwknop/

Yeah. It depends on how persistent they are. Using DROP on all closed ports may discourage some attackers. Others may remain undeterred.

Reply on news.ycombinator.com