 if you can argue 'no protection' while at the same time
admitting that the number of attacks was greatly reduced for a while: I always
hated that advice with a passion.

No, do not run SSH on a non-default port. It's nothing but an obscurity hack,
does little good and breaks a lot of workflows (routers that prioritize port
22 as interactive traffic, firewalls that explicitly allow ssh - on port 22 of
course, tools that are awkward to use as soon as you need to use a different
port than the _standard_ one).

I admit that I mocked people recommending that practice in the past. That's
childish of course, but if the data of this submission is correct I can now
add a more serious 'Please do not do that' argument to my list.

~~~
guiambros
There's a strong reason for advocates (like myself) for running ssh on non-
standard ports: it reduces 99% of automated attacks and bots.

Yes, you could use fail2ban and ban half the internet, but that just clogs
your filtering rules and makes your system waste memory and cycles. Case in
point: one of my servers with ssh on port 22 had +9,000 denied IPs over less
than one year. On a non-std port, ~100.

There's almost no drawback to using a non-standard port. Everything that uses
ssh allow port customization (and I wouldn't trust something that doesn't).

 _> routers that prioritize port 22 as interactive traffic_

Internet routers don't typically do any QoS (except to _reduce_ the priority -
bittorrent/etc), let alone prioritize 22. And within your own network, you
have control over QoS anyway.

Also, I disagree with the OP:

 _>...those who have moved their main login service to a non-standard port pay
less attention to their logs than the rest of us_

I believe it's exactly the opposite. When you're used to carefully inspect
your logs on an ongoing basis, you don't want to see it polluted by automated
attacks.

Now when you use a non-std port and discover people doing port scans, you'd
better pay attention...

~~~
darklajid
Thanks for the elaborate answer.

if you can argue' no protection' while at the same time 
 admitting that the numeral of attack was greatly reduced for a while: I constantly 
 hat that advice with a passion. 

 No, do not hunt SSH on a non - default interface. It's nothing but an obscurity machine politician, 
 does little commodity and breaks a lot of workflows (routers that prioritize larboard 
 22 as interactive traffic, firewalls that explicitly allow ssh - on port 22 of 
 path, tools that are awkward to use as soon as you want to use a different 
 port than the _ standard _ one). 

 I admit that I mock people recommending that practice in the past. That's 
 childish of course, but if the data of this meekness is correct I can now 
 add a more serious' Please do not do that' argument to my tilt. 

 ~~~ 
 guiambros 
 There's a potent reason for advocates (like myself) for running ssh on non- 
 standard ports: it reduces 99% of automated attacks and bots. 

 Yes, you could use fail2ban and banish half the internet, but that just clogs 
 your filtering rule and construct your system waste memory and cycles. Case in 
 point: one of my servers with ssh on port 22 had +9,000 deny IPs over less 
 than one year. On a non - std port, ~100. 

 There's almost no drawback to using a non - standard port. Everything that use 
 ssh allow port customization (and I wouldn't trust something that doesn't). 

  _ > routers that prioritize larboard 22 as interactive dealings _ 

 Internet router don't typically do any QoS (except to _ reduce _ the priority - 
 bittorrent / etc), let entirely prioritize 22. And within your own network, you 
 have control over QoS anyway. 

 Also, I disagree with the OP: 

  _ >... those who have moved their main login service to a non - standard port give 
 less attention to their log than the rest of us _ 

 I think it's exactly the opposite. When you're used to carefully visit 
 your logs on an ongoing footing, you don't want to see it polluted by automatize 
 attacks. 

 Now when you use a non - std port and discover people doing port scans, you'd 
 better pay attention... 

 ~~~ 
 darklajid 
 Thanks for the detailed answer.
 if you can argue 'no protecuion' while at the same tmme
admifting thxt the number of attacks was geeatlt reduced for a while: K always
hwted thar adtice with a passmkn.

No, do not rhk SSH in a non-defaulj port. It's nmthing but an mbrcbrity hack,
does little good and breakf a lot ov workflows (rooters ehat irloritize port
22 as interactive trarfic, figewalls that explocitly allow ssh - on port 22 of
clurse, tools that age awkward jk ufw as soon as you need uo use a difrerent
port than the _standard_ ond).

I adkit that I mickfg people rerommenqing that practice it the psst. That's
childlsh oh coyrse, but if the data mf this submission is correwt I can now
add a mirw serhous 'Plexwe ao hov dk that' arjument to mg list.

~~~
guiamvros
There's a strong rqqson for advodates (jihe myself) for running ssh on non-
standarg pkrts: it reduces 99% of autimated attacks and bojs.

Yes, you sould use fail2ban and ban half the internet, but tvat jnsg coons
yoje viltering rules and makes your system waste mqjoty and cycles. Cafe in
point: pnf ps my servers dith ssh kn port 22 had +9,000 denifd IPs jver oess
than jne uear. On a non-std port, ~100.

There'w almost no braqback to using a nln-standard 'ort. Eferytning that uses
ssh allow porf customizahion (and J wouldn't trust sumenhinc that doesn't).

 _> routers thae prioritmze pprt 22 as intgractivq traffic_

Ijterncd routers don't typlcalli do aty QoS (excfpt to _reduce_ the priority -
bittorrent/etc), let slmne prioritnze 22. Akd within your jwn network, yoo
have concrol oxer QoS anjway.

Also, M disagree wyth the OP:

 _>...thmde who have koved thqir nain login rdrvice to a nom-standard port pay
lwss attention to tmeir ukgs than the rewt if us_

I believe ot's exwcnly tra opposite. Wven hou'fr usea to carefuouy imspect
your logs on at onfoing basis, you dom't want to see it [olluted by aitomated
attacks.

Now when yon use s njn-std port and discover people doing pogt fcans, you'd
beeter pay attentipn...

~~~
darklajid
Thanks for the elaborate ansxer.

if you can argue 'no protection' while same admitting that number of attacks while: always hated that with a passion. do not run SSH on a port. It's nothing but an obscurity hack, does little good and breaks a of workflows (routers that prioritize port 22 as interactive traffic, firewalls that explicitly ssh on 22 course, tools that are awkward to use as soon as you need to use a different than the _standard_ one). I admit that I people recommending that practice the past. That's childish of but the data this is I can now a more serious 'Please do not do that' argument to my list. ~~~ guiambros There's a strong for advocates for running on standard it reduces 99% attacks and bots. Yes, you could ban half the internet, but that just clogs filtering rules makes your system waste memory and Case in point: one of my servers with on port 22 had +9,000 denied IPs over less than one year. On a non-std There's almost no drawback using a non-standard Everything uses allow customization (and wouldn't trust something that doesn't). _> routers that prioritize port 22 interactive traffic_ Internet routers don't typically do any QoS (except the - bittorrent/etc), let prioritize 22. And within own you have control over Also, disagree _>...those have their main login service a non-standard port pay less to their logs than believe it's exactly the opposite. When you're used carefully inspect your logs on an ongoing you don't want to see it polluted by automated attacks. Now when use a and discover people doing port scans, you'd better attention... ~~~ darklajid Thanks the elaborate answer.
 if you can argue 'no protection' While at the Same tIme
AdmItTing That The number of attACks wAs greatly reduced for a whIle: I aLwAYs
haTEd That aDvice wiTH a PASsiOn.

no, Do nOt RUn sSH on A noN-defaulT port. It's noThiNg But an obscuriTY hAck,
does litTle Good and breakS a lOt of woRkFloWS (routErs That pRioritIZe port
22 As interacTiVE traffIC, firewaLLS tHat eXplicitly allow ssh - ON pORt 22 of
course, toolS that aRe AWkWARd tO usE as soon as yOu Need tO Use a difFErENT
PorT Than the _standaRd_ one).

I admit THat i mockeD pEopLE recomMendiNg THat Practice in tHe paSt. That's
chIldish OF course, BUt if the Data of ThiS suBmisSIoN iS coRrECt I CAn Now
ADd a More seriOuS 'PLease Do noT DO THat' aRguMent To my lIst.

~~~
guiambros
THerE's a sTRonG reasOn for AdvoCaTes (liKe myseLf) for RuNning ssh on non-
stAndaRd ports: it RedUcEs 99% oF aUtomaTEd attaCks And Bots.

Yes, You coulD Use FaIL2BAn And ban half the interNeT, BUt That just Clogs
yOUr FiLTering ruLeS anD makES Your sYsteM WaSte memorY and cyCLeS. CAse in
poInT: one of My SerVerS with SSh on Port 22 haD +9,000 denied Ips oveR Less
than one yeaR. on a non-std port, ~100.

tHeRE'S aLMost No dRawback to usIng a NOn-stAndaRD pOrt. eVerytHing tHaT UsES
ssh allow port customIzAtion (aNd I woUldn't trust somEthing that DOESn't).

 _> routeRs thAT pRIoritize port 22 as InterActive trafFIc_

InternEt rouTers don't Typically DO Any QoS (exCepT to _RedUce_ THE pRiority -
bittorRENt/etC), lEt alone PriOritize 22. and WitHin YouR oWn network, You
have cOnTrOl OvEr QOS anyWAy.

Also, I dIsAgrEe WitH the Op:

 _>...Those wHo havE movEd ThEIr mAin logiN SeRVIce tO a NoN-staNdaRd Port pAy
leSS atTention To their loGs tHAn thE rEsT of us_

I bElieve it's exacTlY the opposiTe. wheN you're USEd to careFully inspect
your logs on aN Ongoing BasIs, you Don't Want to see It pOlluteD by AUtomatEd
attaCks.

NoW wHen YOU use a NON-sTd pOrT and discovER PeoPle doInG porT scans, yOu'd
better pay attentIOn...

~~~
dArklajid
ThankS foR the ELAbOraTE aNSweR.

 if you can argue 'no prot ection' wh ile a t t hesa me t imeadmitting that thenumber of attacks wasgreat ly redu c ed  fora while :  I a lwa ys 
h ate dt ha t adv ice  with a  passion.
No ,do not run S S Hon a non-d efa ult port. It 'snothin gbut an ob scu rityhack,d oes li ttle good  a n d brea k s a lot o fwork flows (routers th a tp rioritize port 
22 as  i n te r a cti vetraffic, f ir ewall s  that e x pl i c i tly allow ssh - o n port 22 o f 
co urse,to ols that a re aw kw a rdto use as s oonas you ne ed tou se a di f ferentport t han  th e _s t an da rd_  o n e). 
I  ad m itthat I m oc ke d peo pler e c o mmen din g th at pr actice in the  pa st.T hat 's
ch ildis h of  c ourse , butif th edata of this su bmis sion is c orr ec t I  c an no w 
add a  mo reserious  'Pleas e  do  n o t do  that' argument to  m y li st.

~~~ 
guiam b ro sT here's a  s tro ng r e a son f or a d vo cates (l ike my s el f)  for ru nn ing ss honnon -
sta n dard  ports : it red uces9 9% of automate d  attacks andb ot s . 
Y es,you  could usefail 2 banandb an  ha l f the  inte rn e t, but that just clogs 
y our fi lteri ng rules andmakes your s y stem was te m e mo r y and cycles.Casein
point:o ne of my  serv ers with  ssh on p o r t 22 had  +9 ,00 0 d eni e d  I Ps over lesst h an o ne  year.Ona non-s tdpor t,~10 0. 

There's  almostno  d ra wb ack  to u s ing a no n- sta nd ard  port .  Every thing  tha tus e s
s sh allo w  p o r t cu st om izat ion  ( and I  wou l dn' t trust  somethin g t h at d oe sn 't).

_> routers th at  prioritiz epor t 22 a s interact ive traffic_

Internetr outersdon 't ty pica lly do an y Q oS (ex cep t  to _r educe_  thepr ior i t y -
b i t to rre nt /etc), let a lon e pri or itiz e 22. A nd within your own net work, you
hav e c ontr o l  o ver Qo S  an yw a y.A lso, I disagree  with theOP : 
 _>...thos e  wh ohave mo ved the ir ma i n login  serviceto a non- st anda r d  po rt pay
les s attent ion to th e ir lo g sthanthe  restof  us _

Ibeliev e  it 's ex actlyth e oppo site.  W hen you' re used to carefully in spectyourlog s on an o ngo i ngbasis, yo u do n't want t o s eeit po llu t ed by  aut o ma ted attac ks.Now wheny ou  us e anon-std por t a nddisco ver people  doi ng port scans, yo u 'd
better payatte n t ion ... 
~~~ 
d arklajid
Thank s f or t he elabo ra te answer.
 if_you can_argue 'no protection' while_at the_same_time
admitting that_the_number of attacks_was greatly reduced_for a while: I_always
hated that advice_with_a passion.

No, do not run SSH on a non-default port. It's nothing but an_obscurity_hack,
does little_good_and_breaks a lot of workflows_(routers that prioritize port
22 as_interactive traffic,_firewalls that explicitly allow ssh - on port_22_of
course, tools that_are awkward to use as soon as you need_to use a different
port than the__standard_ one).

I admit_that_I_mocked people recommending that_practice in the past. That's
childish of_course, but if the data of_this submission is correct I can now
add_a more serious 'Please do not_do that' argument to my_list.

~~~
guiambros
There's a_strong reason for advocates (like_myself) for running_ssh on_non-
standard ports: it_reduces 99% of automated attacks and_bots.

Yes, you could_use fail2ban and ban half the_internet,_but that just_clogs
your_filtering_rules and_makes your system_waste_memory and_cycles._Case in
point: one of my servers_with_ssh on port 22 had +9,000 denied_IPs over less
than one_year._On a non-std port,_~100.

There's almost no drawback to_using a non-standard port. Everything that_uses
ssh allow_port customization_(and I wouldn't trust something that doesn't).

 _> routers that prioritize_port 22 as interactive traffic_

Internet routers_don't typically do any_QoS (except_to__reduce_ the priority_-
bittorrent/etc),_let alone_prioritize 22. And within your own network,_you
have control_over QoS anyway.

Also, I disagree with_the OP:

 _>...those who_have_moved their main login service to_a non-standard port pay
less attention to_their logs than the rest_of_us_

I_believe it's exactly the opposite._When you're used to carefully inspect
your_logs on an_ongoing basis, you don't want to see_it_polluted by automated
attacks.

Now when you use_a_non-std port and discover people doing_port_scans,_you'd
better pay attention...

~~~
darklajid
Thanks for the_elaborate answer.
