On Fri, February 13, 2015 9:05 am, Always Learning wrote: > > On Fri, 2015-02-13 at 09:46 -0500, Lamar Owen wrote: > >> On 02/13/2015 09:15 AM, Chris Adams wrote: >> > Yeah, the old "move stuff to alternate ports" thing is largely a waste >> > of time and just makes it more difficult for legitimate use. With >> > large bot networks and tools like zmap, finding services on alternate >> > ports is not that hard for the "bad guys". > >> Having SSH on 22 is lower-hanging fruit than having SSH on a different >> port. Sure, an NBA all-star will be able to reach the apples at the top >> of the tree easily, but most people are not NBA all-stars. Most >> port-scanners do not scan all possible ports. >> >> And I am fully aware that people in the 'it's a waste of time' camp are >> unmoved by that. It's not worth arguing about; those who move to >> non-standard ports are going to want to do it anyway. > > Lamar's comments are very sensible. > > I always change the SSH port to something conspicuously different. Every > server has a different and difficult to guess SSH port number with > access restricted to a few IP addresses. > > Waste of time = all the time and energy required to clean-up after a > hacker's breech when a few seconds work selecting a different port could > make a beneficial improvement to security. > Just to mention (even though someone already mentioned that): changing port numbers, or, say removing disclosure by the daemon what software, version, ... it is does not really add security. Security through obscurity is only considered to be efficient by Windows folks. Quite wrongfully IMHO. So, I would suggest to not do these "non-standard" things fooling yourself in wrongful feeling of better security. But instead, maintain the daemons updated. Keep passwords reasonably sophisticated. Do not start unnecessary services. Defend against brute force attacks (I use "--hitcount" option of iptabels on Linuxes and sshguard on FreeBSD). And speaking of security: maintain system free of local exploits (update, update, update...), that is if (when I always consider it for my systems) the bad guys are already in, they can not successfully elevate privileges. Each of the above is like big chapter on system security each said in one short phrase. And most importantly, read good fundamental Unix/Linux system book, and revisit your system configurations (from security point of view) while reading. Just my $0.02 Valeri ++++++++++++++++++++++++++++++++++++++++ Valeri Galtsev Sr System Administrator Department of Astronomy and Astrophysics Kavli Institute for Cosmological Physics University of Chicago Phone: 773-702-4247 ++++++++++++++++++++++++++++++++++++++++