Les Bell wrote: > "David Dyer-Bennet" <dd-b at dd-b.net> wrote: > > Yes, but if there are *any* ports exposed, seems like those are equally > possible. > << > > Sort of. Changing the port used by sshd stops the completely clueless > script kiddies, since they don't even bother looking at anything other than > port 22. Putting it way up high, among the ephemeral ports, will slow down > the slightly more clueful who perform nmap scans, since nmap only scans > around 1500 ports by default, and if sshd isn't running on one of those, > they won't spot it. > Indeed. A relatively small botnet (~500 bots) can scan the complete IPv4 address space for a single port (port 22) in 24 hours so in theory any hacker with meagre resources could map every standard SSH installation on the internet in a single day. If you run SSH on port 22 it *will* get discovered and probed. > However, it won't deter the intelligent or curious attacker; these guys > will scan all ports (slowly, so you may not even notice them) and they will > use banner enumeration to identify the services, rather than assuming. > Yes, moving SSH to a non-standard port will likely prevent the casual hacker looking for vulnerable installations but it won't protect against targeted attacks towards specific servers where a full scan is more likely to be performed. > Moving sshd to a non-standard port is one of the worst examples of relying > on security by obscurity. Its only advantage is that it cuts out some noise > in the logs, but proper precautions do that as well, without lulling you > into a false sense of security. Rate limiting, combined with enforcement of > really strong passwords, or even better, public/private key authentication, > is real security. I don't think anyone is suggesting running SSH on a non-standard port as a sole means of defence, but rather as part of a layered approach where it is very effective in what it is designed to do - namely to vastly reduce the number of random brute-forcing attempts and concomitant noise in log files not to mention reducing the overall load on other mechanisms of defence such as firewall scripts etc. Moreover, rate limiting is not as effective as it used to be as there is now evidence that attackers are using distributed methods of attack utilizing multiple random IP addresses that circumnavigate defences that rely on attacks originating from a single IP address. Studies suggest attackers will try a handful of common account names/passwords and then move on as that's what yields the highest returns for them. We should also remember that public/private key authentication is only secure as the host the private key is stored on when keys without passphrases are employed (all too common where users don't want to trade using a password for a passphrase). If a user account gets hacked then the keys to the kingdom are there for the taking and the hacker has instant access to any SSH servers which employ public/private key authentication (without passphrases). > > A useful additional layer of defence, if you want it, is a daemon that will > watch for port scans on the simple services ports and immediately insert a > firewall rule to block that source - such as the old PortSentry, if you can > find it, or some more modern equivalent. Of course, this won't do much to > defend against some types of stealthy scans, such as idle time scans. > > Best, > > --- Les Bell, RHCE, CISSP > [http://www.lesbell.com.au] > Tel: +61 2 9451 1144 > FreeWorldDialup: 800909 >