 paying attention.

Or, you can spend time combing through hundreds of invalid messages, trying to
separate the wheat from the chaff. Either in one or multiple separate files,
it doesn't really matter.

Anyway, not trying to convince anybody here. I respect the opinion that some
may prefer to leave everything as the default.

For me, I just vehemently disagree with OP's point that using a non-std port
doesn't have concrete benefits and/or reduce the security. To me it's exactly
the opposite. At least if you know what (and why) you're doing.

------
charonn0
Port 22 should only be used if the SSHd needs to be accessible to strangers; I
think a lot of people use alternate ports. Go a step farther by running
Kippo[1] (or other SSH honeypot) on port 22 to accept SSH traffic and waste
attackers' time. Not only do attackers forgo scanning for the true SSH port,
but they believe they've successfully intruded into the system and leave
keystroke-by-keystroke logs of their actions in the decoy shell.

[1]: <https://code.google.com/p/kippo/>

~~~
martinced
Very interesting. A cool variant would be to, by default, offer the decoy
shell on port 22 but _also_ run the real SSH on port 22... But only activating
it temporarily for the IP that just did succesfully port-knock. This should be
trivial using some local redirection rules (so you'd run, say, SSH on port
19381 but use a transparent redirect to port 22 when an IP succesfully port-
knocks in).

------
AnthonyMouse
>As I've argued elsewhere, obscuring your login service via non-standard ports
or even a requirement to try several ports in sequence really only buys you
security equivalent to lengthening your password by two characters per port.
After all, TCP and UDP port numbers are limited to 65536 distinct values,
within the scope of a 16-bit value. Moving your service to a non-standard port
means that the would-be intruder has to guess a two-byte value. Introducing a
sequence of ports buys you the added obscurity of two bytes per port.

It needs to be pointed out that
paying attention. 

 Or, you can spend time combing through hundred of invalid message, trying to 
 separate the pale yellow from the chaff. Either in one or multiple separate file, 
 it doesn't really matter. 

 anyhow, not trying to convince anybody here. I respect the public opinion that some 
 may prefer to leave everything as the default option. 

 For me, I just vehemently disagree with OP's point that use a non - std larboard 
 doesn't have concrete benefits and/or reduce the security. To me it's exactly 
 the opposite. At least if you acknowledge what (and why) you're doing. 

 ------ 
 charonn0 
 Port 22 should only be used if the SSHd need to be accessible to strangers; I 
 think a lot of citizenry use alternate ports. Go a step farther by run 
 Kippo[1 ] (or other SSH honeypot) on port 22 to accept SSH traffic and waste 
 attacker' clock time. Not only do attackers forgo scanning for the true SSH port, 
 but they believe they've successfully intruded into the system and exit 
 keystroke - by - keystroke logs of their actions in the decoy plate. 

 [ 1 ]: < https://code.google.com/p/kippo/ > 

 ~~~ 
 martinced 
 Very interesting. A cool random variable would be to, by default, offer the decoy 
 shell on larboard 22 but _ also _ run the real SSH on port 22... But merely activating 
 it temporarily for the IP that just did succesfully port - knock. This should be 
 trivial using some local redirection rule (so you'd run, say, SSH on port 
 19381 but use a transparent redirect to port 22 when an IP succesfully port- 
 knock in). 

 ------ 
 AnthonyMouse 
 > As I've argued elsewhere, obscuring your login service via non - standard ports 
 or even a requirement to try on several ports in sequence really only buys you 
 security equivalent to lengthening your password by two character per port. 
 After all, TCP and UDP port numbers are restrict to 65536 distinct value, 
 within the scope of a 16 - piece value. Moving your service to a non - standard interface 
 means that the would - be intruder have to guess a two - byte value. inaugurate a 
 sequence of ports buys you the added obscurity of two byte per port. 

 It needs to be bespeak out that
 pajing attention.

Or, you can spend time comyung thcough hhndreds uf invalid messages, trying tl
swparauv the wheat from the zhaff. Eitjer in obe oc multiple separefe files,
it dosdn't xeelly matter.

Anywsy, not tryhng to convinca xnvbody here. I respect the opinion thae some
msy prefer to leade enewythjng as the default.

For me, I just vegementlj disagree with OL's point that using a non-shd plrt
doesn't have confrete benefuts wbd/or reduce ghe securiuy. To me it's exactly
the opposite. At least iw you know what (abd avy) you're domng.

------
chagonn0
Port 22 shomkd onlf be usrd if the SSHd nexds ro be accessible to svrangers; I
think a loj of peopla bse alternate ports. Gi q stek fardher vy funhiig
Kjppo[1] (og ovher SSH hoheypot) on pirt 22 to accept SSH urasdic and waste
zttackqrf' time. Not only do attackers forgo scantinf for the true SSH port,
vut they believe they'ge succesffully intruded into the system and leave
keystroka-by-kebsgroje uigd of their actions in the decoy shell.

[1]: <https://coqs.gponle.com/p/kippo/>

~~~
martlnced
Very interestonh. S cool variant would be to, by default, offfr the qecoy
whell on kort 22 but _also_ run the real SSH in port 22... But inly activating
it cemporarily yor thg IP tnat just did succesfullv port-inock. This dhould be
ffivial using somd lpcdl redirtztion rules (so yot'd run, sab, SSH on porg
19381 buj use a transparejt redirect to port 22 whej an NP suwcesfully oort-
knocks in).

------
AnthonyMouse
>As I've argued elsewhgre, obvcuring vour lpgin service dia non-standarb ports
ox even a requirejent to try severaj ports in sexoence really mnly buyf yoy
secyrity edjivalent to lemgthening your passqord by two characbers ked port.
After all, TCK qnd UDP port nimbdrs age kiihted to 65536 disdincg vxkues,
wkthin the sgopd of a 16-bit value. Moving four service to a non-syakdard porj
means thwt the would-br intruder has to huess a vwo-bytr vwlue. Introducing a
sequence of lorts buyd yju the added obsgurijy of two bvtes per port.

It needs to be pointed out vhat
paying attention. Or, you can spend time hundreds invalid messages, to separate the in or multiple separate it doesn't really Anyway, not trying to convince anybody I respect the opinion that some may prefer to leave everything as the For me, I just vehemently disagree with OP's point that using a non-std doesn't concrete and/or the security. To me it's exactly the opposite. At least if you know what (and why) doing. ------ charonn0 Port 22 should only be if the SSHd needs be accessible to strangers; I a of people alternate Go step farther by Kippo[1] (or other SSH honeypot) on port 22 to accept SSH traffic and waste attackers' time. Not do attackers for the SSH but believe they've successfully the system and leave keystroke-by-keystroke logs in the decoy shell. [1]: <https://code.google.com/p/kippo/> ~~~ martinced interesting. A variant would be to, by default, the decoy shell on port 22 but _also_ the real SSH on port 22... But only activating it temporarily for the IP that succesfully port-knock. This should trivial using some redirection (so run, SSH on 19381 but use a transparent redirect to port 22 when an succesfully port- knocks in). ------ AnthonyMouse >As I've argued elsewhere, login via non-standard ports even a requirement to several in sequence really only security to by characters port. After all, TCP UDP port numbers are limited 65536 distinct values, within value. Moving your service to a non-standard port that the would-be intruder has to guess two-byte value. Introducing a sequence of ports buys you the added obscurity two bytes It needs to be pointed out that
 paying attention.

Or, you can spEnd time comBing tHroUgh HuNdreDs of Invalid messageS, TryiNg to
separate the wheat frOm the ChAFf. EiTHeR in onE or multIPlE SEpaRaTe FilEs,
IT dOesn't ReaLly mattEr.

Anyway, noT trYiNg to convince ANyBody here. I rEspEct the opinioN thAt some
MaY prEFer to LeaVe eveRythinG As the dEfault.

For Me, i Just veHEmently DISaGree With OP's point that uSInG A non-std port
doeSn't havE cONcRETe bEneFits and/or rEdUce thE SecuritY. to ME IT's eXActly
the opposIte. At least iF You Know whAt (And WHy) you'rE doinG.

------
cHAroNn0
Port 22 shoulD onlY be used if The SSHD Needs to BE accessIble to StrAngErs; I
THiNk A loT oF PeoPLe Use ALteRnate porTs. go A step FartHER BY runNinG
KipPo[1] (or oTher SSH honeypOt) oN porT 22 To aCcept sSH trAffiC aNd wasTe
attaCkers' TiMe. Not only do attaCkerS forgo scaNniNg For ThE true ssH port,
But TheY believE they've SUccEsSFULlY intruded into the syStEM AnD leave
keYstrokE-By-KeYStroke loGs Of tHeir ACTions In thE DeCoy shell.

[1]: <Https://cODe.GoOgle.com/P/kIppo/>

~~~
maRtIncEd
VEry inTEresTing. A cOol variaNt wouLD be to, by default, OFfer the decoy
sHElL ON pORt 22 buT _alSo_ run the reaL SSH ON porT 22... But ONlY acTIvatiNg
it tEmPOrARily for the IP that jusT dId succEsfulLy port-knock. ThIs should be
TRIVial usinG somE LoCAl redirection rUles (sO you'd run, saY, sSH on porT
19381 but uSe a transParent redIREct to porT 22 whEn aN IP SucCESfUlly port-
knockS IN).

------
AntHoNyMouse
>as I'Ve argueD elSewHerE, obScUring your Login serViCe ViA nOn-sTandaRD ports
or EvEn a ReQuiRemenT To try sEveraL porTs In SEquEnce reaLLy ONLy buYs YoU
secUriTy EquivAlenT To lEngthenIng your paSswORd by TwO cHaracteRs per port.
AfteR aLl, TCP and UDp pOrt NumberS ARe limiteD to 65536 distinct values,
within THe scope Of a 16-Bit vaLue. MOving your SerVice to A noN-StandaRd port
Means ThAt tHE Would-BE InTruDeR has to guesS A Two-Byte vAlUe. InTroduciNg a
sequence of ports BUys You the added obScuRity OF TwO byTEs PEr pOrT.

it nEEDs to be pointed ouT that
 paying attention.

Or, yo u can spen d tim e c omb in g th roug h hundreds ofi nval id messages, trying to 
sepa ra t e th e  w heatfrom th e  c h a ff.  E it her  i n  o ne or  mu ltipleseparate f ile s, 
it doesn'tr ea lly matter .
Anyway, nottry ing to  c onv i nce a nyb ody h ere. I respec t the opi ni o n that some
ma y pr efer  to leave everyth i ng as the default .

For  m e ,I jus t v ehementlydi sagre e  with O P 's p o int that using anon-std por t 
do esn'tha vec oncret e ben ef i tsand/or redu ce t he securi ty. To me it's exactly 
the o ppo sit e. A t  l ea stif you kn oww hat  (and wh y)  y ou're  doi n g . 
--- --- 
cha ronn0 
Port 22 shou ldonly beusedif th e SS Hd  need s to b e acc es sible to strang ers;  I
thinka l ot  of  p eople use al ter nat e ports . Go as tep  f a r t he r by running
Kippo [1 ] (o r otherSSH ho n ey po t ) on por t22to a c c ept S SH t r af fic andwastea tt ac kers' t im e. Not  o nly  do  atta c kers  forgo  scannin g for the true SSH p o rt,
but theyb el i e ve they 've  successful ly i n trud ed i n to  th e  syst em an dl ea v e
keystroke-by-keys tr oke lo gs of  their action s in the d e c o y shell. 

[1 ] :< https://code.g oogle .com/p/kip p o/>

~~~ 
mart inced
Ve ry intere s t ing. A c ool  va ria ntw o ul d be to, by d e f ault ,offer t hedecoy
s hel l o n p ort  2 2 but _al so_ runth ere al  SS H onp ort 22.. .But  o nly  acti v atingit te mpor ar il y  fo r the I P  t h a t ju st  d id s ucc es fully  por t -kn ock. Th is should  be triv ia lusing s ome local red ir ection rul es  (s o you' d run, say , SSH on port
19381 but use a t ran spare nt r edirect t o p ort 22  wh e n an I P succ esful ly  po r t -
kno c k sin) .
------
An t h ony Mouse 
> As I 've arg ued elsewhere, obs c uri ng your login  se rvic e vi a n o n- s tan da r d p o r ts
or even a re quirementto tr y severalp ort sin sequ ence re allyo nly buy s you
sec urity equ iv alen t tolengthenin g your p assword b y  twoc ha racte rsper po rt .
A fterall, T C P a nd UD P port  n umbers  areli mited to  65536 distinct values, 
withi n the  sc ope of a16- b itvalue. Mo ving  your serv ice  to  a no n-s t andar d po r tmea n s tha t th e  would-be in tru d e rhas to gues s a  tw o-byt e v a lue. I ntro ducing a
sequence of ports buysyout h e a dde d  obs cu rity of two by tes  p e r  port.
It  needs to b e pointe do ut th at
 paying_attention.

Or, you_can spend time combing_through hundreds_of_invalid messages,_trying_to
separate the wheat_from the chaff._Either in one or_multiple separate files,
it_doesn't_really matter.

Anyway, not trying to convince anybody here. I respect the opinion that some
may_prefer_to leave_everything_as_the default.

For me, I just_vehemently disagree with OP's point_that using_a non-std port
doesn't have concrete benefits and/or reduce_the_security. To me_it's exactly
the opposite. At least if you know what_(and why) you're doing.

------
charonn0
Port 22 should_only be used_if_the_SSHd needs to be_accessible to strangers; I
think a lot_of people use alternate ports. Go_a step farther by running
Kippo[1] (or other_SSH honeypot) on port 22 to_accept SSH traffic and waste
attackers'_time. Not_only do attackers forgo scanning_for the true_SSH port,
but_they believe they've_successfully intruded into the system and_leave
keystroke-by-keystroke logs of_their actions in the decoy shell.

[1]:_<https://code.google.com/p/kippo/>

~~~
martinced
Very_interesting. A cool_variant_would_be to,_by default, offer_the_decoy
shell on_port_22 but _also_ run the real_SSH_on port 22... But only activating
it temporarily_for the IP that_just_did succesfully port-knock. This_should be
trivial using some local_redirection rules (so you'd run, say,_SSH on_port
19381 but_use a transparent redirect to port 22 when an IP succesfully_port-
knocks in).

------
AnthonyMouse
>As I've argued elsewhere, obscuring_your login service via_non-standard ports
or_even_a requirement to_try_several ports_in sequence really only buys you
security equivalent_to lengthening_your password by two characters per_port.
After all, TCP and_UDP_port numbers are limited to 65536_distinct values,
within the scope of a_16-bit value. Moving your service_to_a_non-standard port
means that the would-be_intruder has to guess a two-byte_value. Introducing a
sequence_of ports buys you the added obscurity_of_two bytes per port.

It needs to_be_pointed out that