1

Is it recommended to have sshd listening on a non-standard port? The Ubuntu community documentation has a line which states:

It's not recommended to listen on a non-standard port.

It's on this page. I've always followed this practice and never had problems. Could you specify any situation where the non-standard port would not be a good idea.

Improve this question
1
  • It really depends on why - if just for hiding it, than maybe not. If for setting up a special service for a particular application, then perhaps it is what you need.
    – Shannon Nelson
    Commented Nov 9, 2009 at 5:21

5 Answers 5

Reset to default
4

If you have a machine which you want a number of people to be able to SSH into, running on a non-standard port might make it more confusing for them.

If it's just you, however, running on a port other than 22 has no real drawbacks (assuming you can remember the port number) and it will greatly reduce the number of connection attempts you get from bots performing dictionary attacks.

Improve this answer
2
  • No real drawbacks - as long as he doesn't choose a port that another application relies on.
    – user1931
    Commented Nov 9, 2009 at 3:55
  • You will still get the connection attempts. You'll no longer see them, though.
    – innaM
    Commented Nov 9, 2009 at 9:20
6

Things you should really do when running an ssh server are to turn off root ssh and only use private/public key authentication. Changing the port in my opinion is a low form of security.

Improve this answer
1
  • i am using the keys for authentication, it was the comment on the documentation that confused me. it had no argument for the statement and i've heard that using a non-standard port is generally a good idea, and definitely not the only method of security.
    – Chintan
    Commented Nov 10, 2009 at 3:58
4

Running SSH on a non-standard port is akin to re-locating the ignition key slot in a car to the trunk. Security though obscurity is not security, but it does foil robot scripts that are to stupid to see the extension cord running from the dash through the back seat.

The best way to secure SSH is to prevent root logins completely, and to enforce the use of key pairs by disabling password logins. Additionally, don't take the lazy way out and make password-less keys.

Fighting brute force attacks is better than hiding from them, you don't want those IP's accessing any service on the system once they fail to login as root 100 times in a row. Its rather easy to monitor log files for this and use firewall tools (iptables) to block future requests.

The combination is much more secure .. and you don't have to confuse users with a non standard port :)

Improve this answer
1
  • +1 for iptables only allow some ip-numbers.
    – Johan
    Commented Nov 9, 2009 at 6:08
2

Some caveats with this:

  • You may choose a port which another application already uses
  • Some (poorly coded) applications may have this value hardcoded in as the SSH port, but most will be flexible and allow you to specify a port
  • If other users will be given SSH access, you will need to make sure you've told them it runs on a different port to avoid those annoying late night phone calls

If these aren't an issue for you, go for it!

Improve this answer
1

If you want to run SSH on a standard port, then do yourself a favor and install Blockhosts. Install it, configure it, add it to cron and you should be safe for the most part. At least all brute force attempts won't be useful.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .