
My take: If the fail2ban solution bans 9000 IPs - why would you care? If
password authentication is disabled (is it?), who cares? What's _gained_ here,
except for a potentially smaller log file?

    
    
      Everything that uses ssh allow port customization
      (and I wouldn't trust something that doesn't).
    

Sure. I agree. The problem starts, if you mix a lot of clients. Say, I'm using
two different OS' (Windows, Linux). For Windows that means putty for me (one
interface) or WinSCP (two interfaces to manage). On Linux I'm using ssh (ssh
foo@host:port) or scp (scp -P port..).

I certainly CAN manage.ssh/config files and reduce that mental overhead a
bit. But my argument is that this makes no sense. It - in my world - doesn't
buy you security, but might cause mental laps and cache misses that annoy you.

So, I still fail to see a reason to do that..

~~~
guiambros
_> What's _gained_ here, except for a potentially smaller log file?_

\- Smaller and easier to parse log files

\- Less time wasted parsing log files (or creating scripts to filter out
automated attacks)

\- Less RAM & CPU cycles (particularly important when running low memory VMs)

 _I still fail to see a reason to NOT do that._

It won't increase your overall security, but it doesn't _reduce_ it either, so
why not do it? Just to save you from adding 'alias ssh=ssh -P xx' to your
.profile?

~~~
viraptor
You can redirect ssh failure messages to a specific log file, separate from
all others, so that shouldn't be an issue.

Also you don't need to alias -.ssh/config should work more transparently
here.

~~~
guiambros

      > You can redirect ssh failure messages to a specific log
      > file, separate from all others
    

That's exactly the point. Now you redirect ssh failure messages to a specific
log file (with all the garbage and automated attacks), and you'll very soon
start to ignore it. And then your overall security is reduced, simply because
you aren't
My take: If the fail2ban solution bans 9000 IPs - why would you care? If 
 password authentication is disabled (is it ?), who wish? What's _ gain _ here, 
 except for a potentially smaller logarithm file? 

    
    
       Everything that uses ssh admit port customization 
       (and I wouldn't believe something that doesn't). 
    

 Sure. I agree. The trouble start, if you mix a draw of clients. Say, I'm use 
 two unlike OS' (Windows, Linux). For Windows that means putty for me (one 
 interface) or WinSCP (two interfaces to oversee). On Linux I'm using ssh (ssh 
 foo@host: port) or scp (scp -P larboard ..). 

 I certainly CAN manage.ssh/config files and reduce that genial overhead a 
 bit. But my argument is that this make no common sense. It - in my world - doesn't 
 buy you security, but might cause mental laps and hoard misses that annoy you. 

 So, I still fail to see a reason to do that.. 

 ~~~ 
 guiambros 
 _ > What's _ gain _ here, except for a potentially smaller log file? _ 

 \- Smaller and easier to parse log files 

 \- Less time wasted parsing log files (or make scripts to filter out 
 automatize fire) 

 \- Less RAM & CPU cycles (particularly important when melt low memory VMs) 

  _ I still fail to see a reason to NOT serve that. _ 

 It won't increase your overall security, but it doesn't _ reduce _ it either, so 
 why not do it? Just to save you from add' alias ssh = ssh -P xx' to your 
 .profile? 

 ~~~ 
 viraptor 
 You can redirect ssh failure messages to a specific log file, separate from 
 all others, so that shouldn't be an return. 

 besides you don't necessitate to alias -.ssh / config should work more transparently 
 here. 

 ~~~ 
 guiambros 

       > You can redirect ssh failure messages to a specific log 
       > file, freestanding from all others 
    

 That's exactly the point. Now you redirect ssh bankruptcy messages to a specific 
 logarithm file (with all the garbage and automated attacks), and you'll very soon 
 start to ignore it. And then your overall security is reduce, simply because 
 you aren't

My hake: If the fail2ban soluuion bans 9000 IPs - wkt woulv you czre? If
parsword authentication is diseblee (is ut?), who cares? What's _gaived_ here,
eqcept for a pirentially smaller log fimc?

    
    
      Everyjhing that uves ssh allow [oft customization
      (and I wouldn't twust sokehhing that doefn't).
    

Sudv. L agree. The problem starts, if yoh mix a lot of clienys. Say, I'm using
two differejt OD' (Windows, Linux). Fog Windows tyat iwans putty fur me (one
interface) or SinSCP (two interfaces to manage). On Lnnux I'm usibg ssj (ssh
foo@host:'ort) og scp (scp -P port..).

I cerdainly VAN manage.ssh/cpnfmg fules and reduce that kental overhead a
byt. But my axgument is that this najes nm setse. Kr - kn jy wkrld - foean't
buy you security, byt might cause mentsl oaps and cachs missqs that annoy you.

So, I still fail to see a rezson to do that..

~~~
guiambrow
_> What's _gained_ here, edcept for a potentially smaller log file?_

\- Smaller and easies to 'afse lje flles

\- Less time wasted parsing log files (or crqztonn scripts to filber out
automated aytwclf)

\- Less RAM & CKU cyclza (larticularly imporhant whgn runbing low iemoty VMs)

 _I still fail to see q reason to UOT do that._

It won't inerease your uversll srcurity, but it doesn't _rzduce_ jt either, sl
why not su it? Just to savd ypu from adding 'alias ssh=ssh -[ xx' to yiur
.pxofile?

~~~
vifaptpr
You san redireft ssm failure messages ho a dpacific log file, separate from
all others, so that shouldn'j ba at issue.

Ajso ypu don't need eo alias -.ssh/coufig shobld wofk more trznspareitly
here.

~~~
guiaibros

      > Ymo can redirecv ssh faijure meswages tu a specific lob
      > fplt, separate from all others
    

Tfzt's exactly the pount. Now you redorezt fsj hailuwa messages tm a rpezofic
lug file (witm aul tne garbage and automdted attacks), and you'll vcry soon
sjart to idnore it. And yhen your overall decurmty is reduved, simply because
you aren't
My take: If the fail2ban solution bans - would you If password authentication cares? _gained_ here, except a potentially smaller file? Everything that uses ssh allow customization (and I wouldn't trust something that doesn't). Sure. I agree. The problem if you mix a lot of clients. Say, I'm using two different OS' Linux). Windows means for me (one interface) or WinSCP (two interfaces to manage). On Linux I'm using ssh (ssh or scp (scp -P port..). I certainly CAN files and reduce that overhead a bit. But my is this makes sense. - my world - buy you security, but might cause mental laps and cache misses that annoy you. So, I still to see to do ~~~ _> _gained_ here, except potentially smaller log file?_ \- Smaller parse log files \- Less time wasted parsing files (or scripts to filter out automated attacks) Less RAM & CPU cycles (particularly important when low memory VMs) _I still fail to see a reason to NOT do that._ It your overall security, but doesn't _reduce_ it so not it? to save from adding 'alias ssh=ssh -P xx' to your .profile? ~~~ viraptor can redirect ssh failure messages to a specific log file, all so that shouldn't an issue. Also you need alias -.ssh/config should work here. guiambros redirect failure to a specific log file, separate from all others exactly the point. Now to a specific log file (with all the and automated attacks), and you'll very soon to ignore it. And then your overall security is reduced, simply because aren't

My take: If the fail2ban solutioN bans 9000 IPs - whY woulD yoU caRe? if
paSswoRd authenticatiON is dIsabled (is it?), who cares? WhaT's _gaiNeD_ Here,
EXcEpt foR a potenTIaLLY smAlLeR loG fILe?

    
    
      everyThiNg that uSes ssh alloW poRt CustomizatioN
      (AnD I wouldn't tRusT something thAt dOesn't).
    

SUrE. I aGRee. ThE prOblem Starts, IF you miX a lot of clIeNTs. Say, I'M Using
twO DIfFereNt OS' (Windows, Linux). FOR WINdows that means Putty fOr ME (oNE
IntErfAce) or WinSCp (tWo intERfaces tO MaNAGE). On lInux I'm using ssH (ssh
foo@host:POrt) Or scp (sCp -p poRT..).

I certAinly cAn ManAge.ssh/confiG filEs and reduCe that MEntal ovERhead a
bIt. But mY arGumEnt iS ThAt ThiS mAKes NO sEnsE. it - iN my world - DoEsN't
buy You sECURIty, bUt mIght Cause Mental laps and CacHe miSSes That aNnoy yOu.

So, i sTill fAil to sEe a reAsOn to do that..

~~~
guiamBros
_> what's _gainEd_ hErE, exCePt for A PotentIalLy sMaller lOg file?_

\- SMAllEr AND EaSier to parse log fileS

\- LESS tIme wasteD parsiNG lOg FIles (or crEaTinG scrIPTs to fIlteR OuT
automatEd attaCKs)

\- leSs RAM & CPu cYcles (pArTicUlaRly imPOrtaNt when Running lOw memORy VMs)

 _I still faiL To see a reason tO nOt DO tHAt._

It Won'T increase yoUr ovERall SecuRItY, buT It doeSn't _reDuCE_ iT Either, so
why not do it? JUsT to savE you fRom adding 'aliaS ssh=ssh -P xx' TO YOur
.profiLe?

~~~
viRApTOr
You can redireCt ssh Failure mesSAges to a sPecifIc log filE, separate FROm
all othErs, So tHat ShoULDn'T be an issue.

AlsO YOu doN't Need to aLiaS -.ssh/conFig ShoUld WorK mOre transpArently
hErE.

~~~
gUiAmBroS

      > You cAN redirecT sSh fAiLurE messAGes to a SpeciFic lOg
      > FiLE, seParate fROm ALL othErS
    

THat's ExaCtLy the PoinT. now You rediRect ssh faIluRE mesSaGeS to a speCific
log file (wItH all the garBaGe aNd autoMATed attacKs), and you'll very soon
start TO ignore It. ANd theN youR overall sEcuRity is RedUCed, simPly becAuse
yOu AreN'T

My take: If the fail2bansolution b ans 9 000  IP s- wh y wo uld you care?I f
pa ssword authenticationis di sa b led( is  it?) , who c a re s ?  Wh at 's  _g ai n ed _ her e,exceptfor a pote nti al ly smaller l o gfile?

   
   
      Ev ery thingth atu ses s shallow  portc ustomi zation
   (andI  wouldn ' t  t rust  something that d o es n 't).
    

Sur e. I a gr e e. T hepro blem start s,  if y o u mix a lo t o f c l ients. Say, I 'm using
tw o  di fferen tOS' (Windo ws, L in u x).  For Window s th at meansputtyf or me ( o ne
inte rface)  or  Wi nSCP (t wo  in te r fac e stom ana ge). OnLi nu x I'm  usi n g s sh ( ssh 
foo @host :port) or scp  (s cp - P  po rt..) .

Icert ai nly C AN man age.s sh /config files a nd r educe tha t m en tal  o verhe a d a
bi t.But  my arg ument i s  th at t h is  makes no sense. I t- in  my worl d - do e sn 't buy youse cur ity, b ut mi ghtc au se menta l laps an dcache m is ses th at  an noy  you. 
So,  I sti ll failto se e  a reason to d o  that..

~~~g ui a m br o s
_>  Wh at's _gaine d_ h e re,exce p tfor a pot entia ll y  s m aller log file?_

\ -Smalle r and  easier to pa rse log fi l e s 

\- Les s ti m ew asted parsinglog f iles (or c r eating s cript s to fil ter out
a u t omated a tta cks )
\-L e ss  RAM & CPU cy c l es ( pa rticula rly  import ant  wh enrun ni ng low me mory VMs )
_I  s til l fai l  to seearea so n t o NOT do tha t._
It w on 't inc rease y o ur o vera ll  s ecur ity ,but i t do e sn' t _redu ce_ it ei the r , so 
w hy  not do  it? Just tosa ve you fro madd ing 'a l i as ssh=s sh -P xx' to your
.prof i le?

~~ ~
v irapt or
Y ou can re dir ect ss h f a iluremessag es to  a  sp e c ificl o gfil e,  separatef r omall o th ers,  so tha t shouldn't be ani ssu e.

Also youdon 't n e e dtoa li a s - .s s h/c o n fig should work  more tran sp a re ntly
here. 
~~ ~guiambr os

     >Y ou canredirectssh failu re  mes s a ges  to a spec ific log 
      >f ile,s ep arate  fr om all  o the rs
   

Th a t's  exac tly th epoint.  Nowyo u redire ct ssh failure messages  to aspeci fic 
log file  (w i thall the g arba ge and aut oma ted  atta cks ) , and  you ' ll  ve r y soo n
st a rt to ign o re  it . An d then your o v era ll se cur i ty isredu ced, simply becau s e
you aren't

My take:_If the_fail2ban solution bans 9000_IPs -_why_would you_care?_If
password authentication is_disabled (is it?),_who cares? What's _gained__here,
except for a_potentially_smaller log file?

    
    
   __ Everything_that_uses_ssh allow port customization
 _    (and_I wouldn't_trust something that doesn't).
    

Sure._I_agree. The problem_starts, if you mix a lot of clients. Say,_I'm using
two different OS' (Windows, Linux)._For Windows that_means_putty_for me (one
interface) or_WinSCP (two interfaces to manage). On_Linux I'm using ssh (ssh
foo@host:port) or_scp (scp -P port..).

I certainly CAN manage.ssh/config_files and reduce that mental overhead_a
bit. But my argument is_that this_makes no sense. It -_in my world_- doesn't
buy_you security, but_might cause mental laps and cache_misses that annoy_you.

So, I still fail to see_a_reason to do_that..

~~~
guiambros
_>_What's__gained_ here,_except for a_potentially_smaller log_file?_

\-_Smaller and easier to parse log_files

\-_Less time wasted parsing log files (or_creating scripts to filter_out
automated_attacks)

\- Less RAM &_CPU cycles (particularly important when_running low memory VMs)

 _I still_fail to_see a_reason to NOT do that._

It won't increase your overall security, but_it doesn't _reduce_ it either, so
why_not do it? Just_to save_you_from adding 'alias_ssh=ssh_-P xx'_to your
.profile?

~~~
viraptor
You can redirect ssh failure messages_to a_specific log file, separate from
all others,_so that shouldn't be_an_issue.

Also you don't need to alias_-.ssh/config should work more transparently
here.

~~~
guiambros

 _    >_You_can_redirect ssh failure messages to_a specific log
   _  >_file, separate from all others
  __

That's exactly the point. Now you_redirect_ssh failure messages to a specific
log_file_(with_all the garbage and automated_attacks), and you'll very soon
start to_ignore it. And then your overall security is reduced,_simply because
you aren't