Also, security by obscurity does sometimes work. It's dangerous because you can't depend on it, and often it makes it harder to analyze your security in general. Sometimes, badly implemented security by obscurity can compromise security. In fact, badly implemented security often compromises security, because it is hard to do this stuff. Non-obscure security mechanisms have a distinct advantage -- more eyeballs are looking at them.

So the best policy? I think you should use standard security tools, and then layer simple obscurity over top of that. Keep it minimal so you can make sure it won't mess up some other aspect of your security. It's worth it, just to keep from being the lowest hanging fruit on the tree.

I can't outrun the bear, but I don't have to, because I can outrun you!

err...sortof. They're just looking at port numbers and cross referencing that to services that are known to live on those ports.

Changing the port that SSH listens on isn't going to stop somebody from performing this exploit against one of your machines, it IS going to prevent you from getting auto-rooted by a bot that goes around looking for machines that ack on port 22.

Think of it like a hidden door, but on the front of your house. To the casual observer driving through the neighborhood, they won't see it. To somebody actively trying to find a way into your house...you're going to need more.

I just moved ssh daemons that face the internet to non-standard ports. I suggest everybody does the same to prevent dragnetting (just to be safe).