Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm trying to learn thing or two about server security.

I installed nmap to check my server open ports.

Now I've changed default ports on almost everything. So nmap reports wrong names for the services I'm running.

For example ssh I changed to some random port, and it appears this port is used by some other program, so nmap reports that other program.

I was thinking if it is still possible to determine that ssh is in fact behind this open port? what are tools for this? if this is still possible, then it makes no sense to change default port numbers right?

in fact, I just tried nmap -sV mini.local, and it gave me version of the program so it identified SSH correctly on non standard port.

So what is the point of changing default port #?

share|improve this question
    
Not answering the question directly, but if you are logged on via ssh or some other shell access, then you can run sudo netstat -lntp and it will tell you what process is listening on that port and what the process binary is. –  Kevin M Oct 18 '11 at 16:12
add comment

3 Answers

up vote 2 down vote accepted

Yes, it is possible sometimes to determine what's listening on a particular port. For example, telnet to your "relocated" ssh:

telnet [your.ip.address] [new-ssh-port-number]

Telnet will connect and SSH daemon will respond with something like this:

Trying x.x.x.x...
Connected to x.x.x.x.
Escape character is '^]'.
SSH-2.0-OpenSSH_4.3

Obviously this information is enough to realize that ssh is listening on this port. Many other services (SMTP, POP, etc.) also send banner info. But not all services.

However, connecting to all ports on your computer is time-consuming, especially if your firewall in configured to just drop unwanted connections. Therefore, most attacks are "wholesale": script kiddie tries port 22 on 100,000 computers, etc. Changing the default port for ssh is a useful tactic to avoid these attacks and prevent your logs from filling with useless warnings about these attacks.

However, it's not a real security, it is just security by obscurity. You still need a good password, or even better, ssh daemon configured to accept certificates only, properly configured firewall, etc.

share|improve this answer
add comment

usually, telnet will give you some banner info, or using nmap's banner grabber

share|improve this answer
add comment

For example ssh I changed to some random port, and it appears this port is used by some other program, so nmap reports that other program.

The "well-known port-numbers" are listed in /etc/services, this list is based on a list maintained by the Internet Assigned Numbers Authority (IANA).

so what is the point of changing default port #?

As haimg said it makes life a little bit harder for script-kiddies. In practise I find it cuts out a lot of "noise" in my SSH logs (syslog).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.