1

What would be the advantage of binding a common service to a custom port against cybersecurity attacks?

For example I want to make it harder for a hacker to evaluate the attack surface on my server so could I for example bind ssh to port 888 instead of 22? As far as I understand it would just hinder the attacker but not stop from discovering the service because all services leave fingerprints.

0

2 Answers 2

0

This is an example of Security through Obscurity. It just inconveniences the attacker by having them do a port scan, but it doesn't actually prevent an attack. I would say that the gains are minor, at best.

An indirect byproduct of the port changing may be that the user notices other security settings in need of hardening and doing it, instead of leaving the default configuration in place... But, a security-conscious user would do that anyway.

Lastly, if there is a vulnerability in your implementation and there is some automated attack that ONLY tries the standard and well-known ports, you'll be spared. But, this doesn't apply for targeted attacks. Another minor benefit of changing the port is that your logs will have less content if you change the port, since there won't be automatic authentication attempts from bots trying to find an easy way in and compromise insecure systems.

-1

The security benefit is minimal. Port scanning and service detection are very basic techniques which can be performed quickly and fully automated by standard tools like nmap. Switching from a well-known port to a custom port therefore won't stop anybody who actually wants to attack you.

What it will do is block simple mass scans which just probe a few fixed ports. This means your logs will be less cluttered from the background noise of the Internet. How much that helps you is a different question.

Not the answer you're looking for? Browse other questions tagged .