changing port number - is it still possible to guess what is listenning there?

Question

I'm trying to learn thing or two about server security.

I installed nmap to check my server open ports.

Now I've changed default ports on almost everything. So nmpa reports wrong names for the services I'm running.

For example ssh I changed to some random port, and it appears this port is used by some other program, so nmap reports that other program.

I was thinking if it is still possible to determine that ssh is in fact behind this open port? what are tools for this? if this is still possible, then it makes no sense to change default port numbers right?

in fact, I just tried nmap -sV mini.local, and it gave me version of the program so it identified SSH correctly on non standard port.

so what is the point of changing default port #?

Answer 1

Yes, it is possible sometimes to determine what's listening on a particular port. For example, telnet to your "relocated" ssh:

telnet [your.ip.address] [new-ssh-port-number]

Telnet will connect and SSH daemon will respond with something like this:

Trying x.x.x.x...
Connected to x.x.x.x.
Escape character is '^]'.
SSH-2.0-OpenSSH_4.3

Obviously this information is enough to realize that ssh is listening on this port. Many other services (SMTP, POP, etc.) also send banner info. But not all services.

However, connecting to all ports on your computer is time-consuming, especially if your firewall in configured to just drop unwanted connections. Therefore, most attacks are "wholesale": script kiddie tries port 22 on 100,000 computers, etc. Changing the default port for ssh is a useful tactic to avoid these attacks and prevent your logs from filling with useless warnings about these attacks.

However, it's not a real security, it is just security by obscurity. You still need a good password, or even better, ssh daemon configured to accept certificates only, properly configured firewall, etc.

Answer 2

usually, telnet will give you some banner info, or using nmap's banner grabber

Answer 3

For example ssh I changed to some random port, and it appears this port is used by some other program, so nmap reports that other program.

The "well-known port-numbers" are listed in /etc/services, this list is based on a list maintained by the Internet Assigned Numbers Authority (IANA).

so what is the point of changing default port #?

As haimg said it makes life a little bit harder for script-kiddies. In practise I find it cuts out a lot of "noise" in my SSH logs (syslog).