Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is there any advantage in changing the SSH port, I've seen people do that, but I can't seem to find the reason why.

If you have a strong password and/or a certificate, is it useful for anything?

Edit:

I should also mention that I am using iptables rules to limit brute forcing attacks, only 5 login attempts are allowed per minute per IP address.

share|improve this question
    
I would appreciate if you can clear if this requirement comes from professional office enviroment? –  Saladin Mar 9 '13 at 16:42
    
@asadz No, it doesn't, Its personally bought dedicated/vps servers used to host some website and other services. -- but feel free to reply for both scenarios, so that the answer could benefit both type of environments. –  sharp12345 Mar 9 '13 at 17:23
1  
i just un-deleted my post I previously deleted as i getting negative feedback by site seniors:). Thanks for providing the room to express my thoughts. –  Saladin Mar 9 '13 at 17:56
4  
I changed the SSH port on my Internet-accessible NAS drive so that the drive wouldn't unnecessarily spin up twice an hour just to log a failed login attempt. –  avakar Mar 9 '13 at 18:30
1  
There are reasons that "security by obscurity" is considered a rude word. –  Shadur Mar 9 '13 at 19:41
show 2 more comments

4 Answers

up vote 45 down vote accepted

The Internet is a wild and scary place, full of malcontents whose motives range from curiosity all the way to criminal enterprise. These unsavories are constantly scanning for computers running services they hope to exploit; usually the more common services such as SSH, HTTP, FTP, etc. The scans typically fall into one of two categories:

  1. Recon scans to see what IP address have those services open.
  2. Exploit scans against IP addresses who have been found to be running a specific service.

Considering how large the Internet is it is typically infeasible to look on every port of every IP address to find what's listening everywhere. This is the crux of the advice to change your default port. If these disaffected individuals want to find SSH servers they will start probing each IP address on port 22 (they may also add some common alternates such as 222 or 2222). Then, once they have their list of IP addresses with port 22 open, they will start their password brute force to guess usernames/passwords or launch their exploit kit of choice and start testing known (at least to them) vulnerabilities on the target system.

This means that if you change your SSH port to 34887 then that sweep will pass you on by, likely resulting in you not being targeted by the followup break-in.

Seems rosy right? There are some disadvantages though.

  1. Client Support: Everybody who connects to your server will need to know and use the changed port. If you are in a heavily managed environment, this configuration can be pushed down to the clients, or if you have few enough users it should be easy to communicate.
  2. Documentation Exceptions: Most network devices, such as firewalls and IDSes, are pre-setup for common services to be run on common ports. Any firewall rules related to this service on this device will need to be inspected and possibly modified. Similarly, IDS signatures will be tweaked so as to only perform SSH inspection on port 22. You will need to modify every signature, every time they are updated, with your new port. (As a data point there are currently 136 VRT and ET snort signatures involving SSH).
  3. System Protections: Modern Linuxes often ship with an kernel layer MAC and/or RBAC systems (e.g. SELinux on RedHat based or AppAmor on Debian based) and that are designed to only allow applications to do exactly what they're intended to do. That could range from accessing the /etc/hosts file, to writing to a specific file, or sending a packet out on the network. Depending on how this system is configured it may, by default, forbid sshd from binding to a non-standard port. You would need to maintain a local policy that would allow it.
  4. Other Party Monitoring: If you have an external Information Security division, or outsource monitoring, then they will need to be made aware of the change. When performing a security assessment, or analyzing logs looking for security threats, if I see an SSH server running on a non-standard port (or an SSH server on a non-UNIX/Linux for that matter) I treat it as a potential backdoor and invoke the compromised system part of incident handling procedure. Sometimes it is resolved in 5 minutes after making a call to the administrator and being told it's legitimate, at which point I update documentation, other times it really is badness that gets taken care of. In any event, this can result in down-time for you or, at the least, a nerve racking call when you answer your phone and hear, "Hi, this is Bob from the Information Security Office. I have a few questions for you."

Before changing your port you need to take all of this into account so you know you're making the best decision. Some of those disadvantages may not apply, but some certainly will. Also consider what you're trying to protect yourself against. Often times it is simply easier to just configure your firewall to only allow access to 22 from specific hosts, as opposed to the whole Internet.

share|improve this answer
7  
Also, software like fail2ban will help secure your system much better than arbitrarily changing port numbers will. –  Shadur Mar 9 '13 at 19:41
    
@Shadur Indeed, that or denyhosts are great active defenses. –  Scott Pack Mar 9 '13 at 20:12
2  
@Shadur: See http://en.wikipedia.org/wiki/Defense_in_depth_(computing). If X is a better security strategy than Y, then that may be a reason to use X, but it's not (in itself) a reason to avoid Y. Scott Pack's answer gives actual reasons why it might be better to stick with the default port; your comment does not. –  ruakh Mar 9 '13 at 22:03
8  
Note that running SSH on a port over 1024 (i.e. a non-priveleged port) is actually potentially a security vulnerability. Only root can bind to privileged ports (<1024), so you can know that services running here are at least started by root. Let's say you run SSH on port 2222 and your sshd crashes for some reason. Now any local user can start their own (fake) sshd on port 2222 which might do bad things like stealing your password! –  Tom Marthenal Mar 10 '13 at 6:42
1  
@RandomUs1r: I believe at least one of us is misunderstanding the other. Changing the port won't have any impact on transfer speeds. –  Scott Pack Mar 18 '13 at 17:35
show 3 more comments

Yes it can be, not by increasing security but you can reduce the amount of failed login attempts on your server. I always change my default ssh to reduce the warnings I get from ossec. Also if you use a really random port and someone still tries to access your machine, chances are higher that it is a targeted attack rather than a random scanner.

share|improve this answer
add comment

I suppose it depends on how up to speed you are going to be on patching your server and whether you have any kind of firewall in-front of the server.

If you are leaving the server open to the world and don't have anything setup to alert you or to autoinstall OpenSSH patches then I would suggest moving the server to a random high numbered ports.

Ultimately though just moving the port number doesn deter everyone, sure it deters the script kiddies that are just checking port 80, 22, 23 etc but not if someone were to do a 1-65535 scan.

share|improve this answer
add comment

Changing the port only stops automatic attacks against your SSH and some script kiddies. If someone was targeting you then they could fine the new SSH port. The advantage is that it stops failed login attempts in your logs. I typically have something like Logwatch and SSH on a different port running with PasswordAuthentication set to no in my sshd_config.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.