most recent 30 from superuser.com 2010-03-18T00:59:45Z http://superuser.com/feeds/question/67777 http://www.creativecommons.org/licenses/by-nc/2.5/rdf http://superuser.com/questions/67777/openssh-server-listening-to-non-standard-port-recommended-or-not 0 Chintan http://superuser.com/users/7936 2009-11-09T03:36:37Z 2009-11-09T05:44:12Z

<p>Is it recommended to have sshd listening on a non-standard port? The Ubuntu community documentation has a line which states:</p> <blockquote> <p><em>It's not recommended to listen on a non-standard port.</em></p> </blockquote> <p>It's on <a href="https://help.ubuntu.com/community/SSH/OpenSSH/Configuring#Listen%20on%20a%20Non-Standard%20Port" rel="nofollow">this page</a>. I've always followed this practice and never had problems. Could you specify any situation where the non-standard port would not be a good idea.</p>

http://superuser.com/questions/67777/openssh-server-listening-to-non-standard-port-recommended-or-not/67778#67778 2 Zack Elan http://superuser.com/users/2510 2009-11-09T03:40:24Z 2009-11-09T03:40:24Z

<p>If you have a machine which you want a number of people to be able to SSH into, running on a non-standard port might make it more confusing for them.</p> <p>If it's just you, however, running on a port other than 22 has no real drawbacks (assuming you can remember the port number) and it will greatly reduce the number of connection attempts you get from bots performing dictionary attacks.</p>

http://superuser.com/questions/67777/openssh-server-listening-to-non-standard-port-recommended-or-not/67779#67779 4 user15514 http://superuser.com/users/15514 2009-11-09T03:43:33Z 2009-11-09T03:43:33Z

<p>Things you should really do when running an ssh server are to turn off root ssh and only use private/public key authentication. Changing the port in my opinion is a low form of security.</p>

http://superuser.com/questions/67777/openssh-server-listening-to-non-standard-port-recommended-or-not/67780#67780 1 Nathan Adams http://superuser.com/users/15332 2009-11-09T03:44:01Z 2009-11-09T03:44:01Z

<p>If you want to run SSH on a standard port, then do yourself a favor and install Blockhosts. Install it, configure it, add it to cron and you should be safe for the most part. At least all brute force attempts won't be useful.</p>

http://superuser.com/questions/67777/openssh-server-listening-to-non-standard-port-recommended-or-not/67781#67781 1 John T http://superuser.com/users/1931 2009-11-09T03:49:38Z 2009-11-09T03:49:38Z

<p>Some caveats with this:</p> <ul> <li>You may choose a port which another application already uses</li> <li>Some (poorly coded) applications may have this value hardcoded in as the SSH port, but most will be flexible and allow you to specify a port</li> <li>If other users will be given SSH access, you will need to make sure you've told them it runs on a different port to avoid those annoying late night phone calls</li> </ul> <p>If these aren't an issue for you, go for it!</p>

http://superuser.com/questions/67777/openssh-server-listening-to-non-standard-port-recommended-or-not/67801#67801 3 tinkertim http://superuser.com/users/1658 2009-11-09T05:44:12Z 2009-11-09T05:44:12Z

<p>Running SSH on a non-standard port is akin to re-locating the ignition key slot in a car to the trunk. Security though obscurity is not security, but it does foil robot scripts that are to stupid to see the extension cord running from the dash through the back seat.</p> <p>The best way to secure SSH is to prevent root logins completely, and to enforce the use of key pairs by disabling password logins. Additionally, don't take the lazy way out and make password-less keys.</p> <p>Fighting brute force attacks is better than hiding from them, you don't want those IP's accessing <em>any</em> service on the system once they fail to login as root 100 times in a row. Its rather easy to monitor log files for this and use firewall tools (iptables) to block future requests.</p> <p>The combination is much more secure .. and you don't have to confuse users with a non standard port :)</p>