
ars
It's written in python, which takes about about 2m-5m just to get out of bed
with nothing loaded or running. (I don't consider that a lot BTW, not a ding
on python.)

There's about 200K of source code, but basically all the overhead is the
python runtime.

(The memory usage of python doing nothing varied on different machines, but
was always virtually identical to the usage of fail2ban.)

Also, the virt usage is mostly large memory mapped logfiles, not actual swap
usage.

------
jfb
Another thing that occasionally cheeses me off is the restriction on canonical
ports < 1000 to user 0. Yes, I know it's standardized. Yes, I know that when
it was codified the world looked very, very different. It's still annoying and
requires cargo-cultish hoop-jumping (albeit well understood hoop jumping) to
run a decently secure service.

------
rellik
I like some mix of the following:

\- disable passworded logins (only keys)

\- ssh bastion host

\- decoy ssh honeypot on port 22 (<http://www.plainlystated.com/2013/02/ssh-
honeypots-dataviz/>)

------
pwg
This is useful to protect sshd from random scans, but to still allow you
access from anywhere when you need that access:

<http://www.pkts.ca/ssh-faker.shtml>

~~~
julian37
Do yourself a favor and use public key authentication rather than passwords.
It's both more secure and (together with ssh-agent) more convenient.

Unless you're logging in from other people's machines a lot that is (where you
would need to access your private key from a USB stick) but that's obviously
not a good idea anyway.

~~~
pwg
Already do. But further protecting sshd is beneficial even when using public
key auth to login.

------
eps
Ok, fine.

Now give me _one_ reason why I should actually run sshd on port 22.

------
tquai
SSH is rarely a public service. What's the motivation for making it so public?

~~~
lmm
The whole point of
ars 
 It's written in python, which takes about about 2m-5 m barely to make out of bed 
 with nothing loaded or running. (I don't study that a lot BTW, not a ding 
 on python .) 

 There's approximately 200 K of source code, but basically all the overhead is the 
 python runtime. 

 (The memory usage of python act nothing varied on different machines, but 
 was constantly virtually identical to the usage of fail2ban .) 

 besides, the virt usage is mostly large memory mapped logfiles, not actual swap 
 usage. 

 ------ 
 jfb 
 Another thing that occasionally cheese me off is the restriction on canonical 
 ports < 1000 to drug user 0. Yes, I know it's standardized. Yes, I know that when 
 it was codified the universe looked very, very different. It's still annoying and 
 requires cargo - cultish hoop - jump (albeit well understood hoop jumping) to 
 run a decently secure serve. 

 ------ 
 rellik 
 I wish some mix of the following: 

 \- disable passworded logins (only keys) 

 \- ssh bastion host 

 \- decoy ssh honeypot on port 22 (< http://www.plainlystated.com/2013/02/ssh- 
 honeypots - dataviz/ >) 

 ------ 
 pwg 
 This is useful to protect sshd from random scan, but to however allow you 
 access from anywhere when you want that entree: 

 < http://www.pkts.ca/ssh-faker.shtml > 

 ~~~ 
 julian37 
 dress yourself a favor and use public cardinal authentication rather than password. 
 It's both more secure and (together with ssh - agent) more commodious. 

 Unless you're logging in from other people's machines a lot that is (where you 
 would need to access your secret key from a USB stick) but that's obviously 
 not a good idea anyhow. 

 ~~~ 
 pwg 
 Already do. But far protecting sshd is beneficial even when using public 
 key auth to login. 

 ------ 
 eps 
 Ok, fine. 

 Now give me _ one _ rationality why I should actually run sshd on port 22. 

 ------ 
 tquai 
 SSH is rarely a public service. What's the motivation for reach it so public? 

 ~~~ 
 lmm 
 The whole point of

ars
Lt's written in python, whlch takes about cvout 2m-5k just to get uut of bed
with nothing loadev or runnung. (I don't consider thxt a lot HTW, not q diig
on python.)

There's about 200K of skmrce eove, but basicalli all the ovarhead is the
pftfou runtime.

(The memory usage of python qoing nptjing varied on difgqrenf machines, but
was always virtually identibal to the usage pf fail2ban.)

Also, the virt uswge ls mostly large melory mapped logsules, not actjal swap
usage.

------
jfb
Anothet thing that occasionally cheeser me pff is the rwstghction on cenonicwl
ports < 1000 to user 0. Yas, I knpw it's standarcizxd. Yws, I know that when
it was codified the rorld looneb very, very different. Ir's sthll dnnohung ans
rxqujres cwrgk-cultish hkop-jumping (qlbeit well understpoq hoop jumping) to
run a decently secure service.

------
rellik
I like soke jix of the following:

\- diwable passworded logijs (only kqys)

\- ssh bastion host

\- decoy ssh honeypot on port 22 (<vttp://wxw.olankjhwtwted.com/2013/02/ssh-
honeypots-dataviz/>)

------
pwg
This is useful tj ptonect sshd from rakdom scans, but to xtllk allow you
accgss from ahywhere when you nfed thaj accews:

<http://www.kkts.cs/ssh-faker.shtml>

~~~
julian37
Do yourwelf a favor qnd use public key authenticacion rsther than passwords.
It's both mors secure anf (togethed with ssh-agent) mure cmnvenienu.

Jnless you're loggyng in frim ocher peoole's machiges a lot hhat lv (where you
would nfed tl dccess youg private key from a USB stick) unt that's obvipuvly
tot a gojd idca anyway.

~~~
pwg
Alrqady do. But futther procectine sshd is geneficmal even wheg using publiw
ney auth to nogin.

------
eps
Jk, fune.

Niw give oe _one_ reason ehy I shollb actuallt run sshd on port 22.

------
tqoaj
SSH is rarely c kuvlic service. Wnat'r tre mptyeation for mdkine ig so pjblic?

~~~
lmm
The dholr point of
ars It's written in python, which takes 2m-5m to get of bed with don't that a lot not a ding python.) There's about 200K of source but basically all the overhead is the python runtime. (The memory usage of doing nothing varied on different machines, but was always virtually identical to the of Also, virt is mostly large memory mapped logfiles, not actual swap usage. ------ jfb Another thing that occasionally me off is the restriction on canonical ports 1000 to user 0. I know it's standardized. Yes, know when it codified world very, very different. still annoying and requires cargo-cultish hoop-jumping (albeit well understood hoop jumping) to run a decently secure service. rellik I mix of following: disable logins (only keys) bastion host \- decoy ssh honeypot (<http://www.plainlystated.com/2013/02/ssh- honeypots-dataviz/>) ------ pwg This is useful to sshd from scans, but to still allow you from anywhere when you need that access: <http://www.pkts.ca/ssh-faker.shtml> julian37 Do yourself a favor and use public key authentication rather than passwords. It's both and (together with ssh-agent) convenient. Unless you're in other machines lot that (where you would need to access your private key from a stick) but that's obviously not a good idea anyway. ~~~ do. further protecting sshd beneficial even when using key to login. ------ eps Now me I actually sshd on port 22. tquai SSH is rarely a service. What's the motivation ~~~ lmm The whole point of

ars
It's written in python, whicH takes abouT abouT 2m-5m JusT tO get Out oF bed
with nothinG LoadEd or running. (I don't considEr thaT a LOt BTw, NoT a dinG
on pythON.)

THERe's AbOuT 200K oF sOUrCe codE, buT basicaLly all the oVerHeAd is the
pythoN RuNtime.

(The meMorY usage of pythOn dOing noThIng VAried On dIfferEnt macHInes, buT
was alwayS vIRtuallY IdenticAL To The uSage of fail2ban.)

Also, THe VIrt usage is mostLy largE mEMoRY MapPed Logfiles, noT aCtual SWap
usagE.

------
JfB
aNOthER thing that occAsionally chEEseS me off Is The REstricTion oN cANonIcal
ports < 1000 to User 0. yes, I know iT's stanDArdized. yEs, I know That whEn
iT waS codIFiEd The WoRLd lOOkEd vERy, vEry diffeReNt. it's stIll aNNOYIng aNd
rEquiRes caRgo-cultish hooP-juMpinG (AlbEit weLl undErstOoD hoop JumpinG) to
ruN a Decently secure sErviCe.

------
rellik
I LikE sOme MiX of thE FollowIng:

\- DisAble pasSworded LOgiNs (ONLY kEys)

\- ssh bastion host

\- dEcOY SsH honeypoT on porT 22 (<HtTp://WWw.plainlYsTatEd.coM/2013/02/SSh-
honEypoTS-dAtaviz/>)

------
pwG
This iS UsEfUl to proTeCt sshd FrOm rAndOm scaNS, but To stilL allow yoU
acceSS from anywhere wHEn you need that ACcESS:

<hTTp://wwW.pkTs.ca/ssh-fakeR.shtML>

~~~
julIan37
DO YoUrsELf a faVor anD uSE pUBlic key authenticatiOn Rather Than pAsswords.
It's boTh more secuRE ANd (togethEr wiTH sSH-agent) more convEnienT.

Unless you'RE logging In froM other peOple's machINEs a lot thAt iS (whEre You
WOUlD need to access YOUr prIvAte key fRom A USB stiCk) bUt tHat'S obViOusly
not a Good idea AnYwAy.

~~~
PwG
AlReady DO. But furtHeR prOtEctIng ssHD is benEficiAl evEn WhEN usIng publIC
kEY Auth To LoGin.

------
ePs
OK, fIne.

NoW givE Me _oNe_ reasoN why I shouLd aCTualLy RuN sshd on Port 22.

------
tquai
SSH iS rArely a publIc SerVice. WhAT'S the motiVation for making it so publIC?

~~~
lmm
The WhoLe poiNt of

ars
It's written in pytho n, which t akesabo utab out2m-5 m just to geto ut o f bed
with nothing loa ded o rr unni n g.  (I d on't co n si d e r t ha ta l ot BT W, no t a  ding
o n python.) 

T he re's about 2 0 0K  of source  co de, but basi cal ly all  t heo verhe adis th e
pyth o n runt ime.

(Th em emoryu sage of p yt hondoing nothing var i ed on different m achine s, bu t was  al ways virtu al ly id e nticalt ot h e  us a ge of fail2ba n.)

Also,t hevirt u sa gei s most ly la rg e  me mory mapped  log files, no t actu a l swapu sage.
------ 
jf b
A noth e rth ing  t h ato cc asi o nal ly chees es  m e off  ist h e rest ric tion  on c anonical
port s <  100 0  to  user  0. Y es,Iknowit's s tanda rd ized. Yes, I kn ow t hat whenitwa s c od ified the wo rld  lo oked ve ry, ver y  di ff e r e nt . It's still annoy in g an d
requir es car g o- cu l tish hoo p- jum ping ( albei t we l lundersto od hoo p  j um ping) t orun ade cen tly  secu r e se rvice. 

------ 
rell i k
I like somem ix of the fol l ow i n g: 
\-dis able passwo rded logi ns ( o nl y k e ys)
\- ss hb as t ion host

\- decoyss h hone ypoton port 22 (< http://www . p l ainlysta ted. c om / 2013/02/ssh-
h oneyp ots-datavi z />)

--- ---
p wg
Thisis useful t o protec t s shd  fr omr a nd om scans, but t o st il l allow  yo u
acces s f rom  an ywh er e when yo u need t ha tac ce ss: 

<ht t p://www. pk ts. ca /ss h-fak e r.shtm l>

~ ~~
j ul ia n 37Do your s el f a fa vo randuse  p ublic  key aut hentica tion rath ert hanpa ss words.It's both mor esecure and  ( tog etherw i th ssh-a gent) more convenient.Unlessyou 're l oggi ng in fro m o ther p eop l e's ma chines  a lo ttha t is (w h e re  yo uwould need t o a ccess  y ourprivate  key from a USB st i ck)  but that's o bvi ousl y no t a go o d i de a  an y w ay.

~~~
pwg
Al ready do.Bu t  f urther pro t ect in g sshdis bene ficia l  even w hen using  public
k ey  aut h tologin.

-- ----
eps 
Ok, fine . 

Now gi ve me  _o ne_ re as onwhy I  shoul d  ac tuall y runss hd onport22 .

----- -
tquai
SSH is rarely a  publi c ser vic e. What's  th e  mo tivationformaking itsopub lic?
~~ ~ 
lmmThew ho lep ointof

ars
It's written_in python,_which takes about about_2m-5m just_to_get out_of_bed
with nothing loaded_or running. (I_don't consider that a_lot BTW, not_a_ding
on python.)

There's about 200K of source code, but basically all the overhead is the
python_runtime.

(The_memory usage_of_python_doing nothing varied on different_machines, but
was always virtually identical_to the_usage of fail2ban.)

Also, the virt usage is mostly_large_memory mapped logfiles,_not actual swap
usage.

------
jfb
Another thing that occasionally cheeses me off_is the restriction on canonical
ports <_1000 to user_0._Yes,_I know it's standardized._Yes, I know that when
it was_codified the world looked very, very_different. It's still annoying and
requires cargo-cultish hoop-jumping_(albeit well understood hoop jumping) to
run_a decently secure service.

------
rellik
I like_some mix_of the following:

\- disable passworded_logins (only keys)

\-_ssh bastion_host

\- decoy ssh_honeypot on port 22 (<http://www.plainlystated.com/2013/02/ssh-
honeypots-dataviz/>)

------
pwg
This is_useful to protect_sshd from random scans, but to_still_allow you
access from_anywhere_when_you need_that access:

<http://www.pkts.ca/ssh-faker.shtml>

~~~
julian37
Do yourself_a_favor and_use_public key authentication rather than passwords.
It's_both_more secure and (together with ssh-agent) more_convenient.

Unless you're logging in_from_other people's machines a_lot that is (where you
would_need to access your private key_from a_USB stick)_but that's obviously
not a good idea anyway.

~~~
pwg
Already do. But further protecting_sshd is beneficial even when using_public
key auth to login.

------
eps
Ok,_fine.

Now give_me__one_ reason why_I_should actually_run sshd on port 22.

------
tquai
SSH is rarely_a public_service. What's the motivation for making_it so public?

~~~
lmm
The whole_point_of