Why change default ssh port?

Question

I've noticed lot of admins change default ssh port. Is there any rational reason to do so?

Answer 1

The most likely reason is to make it harder for people randomly trying to brute force any SSH login they can find. My internet-facing machine uses the default SSH port, and my logs used to be filled with stuff like this (excerpted from an actual log file):

sshd[16359]: Invalid user test from 92.241.180.96
sshd[16428]: Invalid user oracle from 92.241.180.96
sshd[16496]: Invalid user backup from 92.241.180.96
sshd[16556]: Invalid user ftpuser from 92.241.180.96
sshd[16612]: Invalid user nagios from 92.241.180.96
sshd[16649]: Invalid user student from 92.241.180.96
sshd[16689]: Invalid user tomcat from 92.241.180.96
sshd[16713]: Invalid user test1 from 92.241.180.96
sshd[16742]: Invalid user test from 92.241.180.96
sshd[16746]: Invalid user cyrus from 92.241.180.96
sshd[16774]: Invalid user temp from 92.241.180.96
sshd[16790]: Invalid user postgres from 92.241.180.96
sshd[16806]: Invalid user samba from 92.241.180.96

These days I use DenyHosts to block IPs that fail to authenticate too many times, but it's probably just as easy to just switch ports; virtually all brute force attacks of this kind aren't going to bother scanning to see if your sshd is listening on another port, they'll just assume you're not running one and move on

Answer 2

No, it's a security by obscurity tactic.

If your sshd setup is not fit enough to face dumb script kiddies only trying port 22, you have a problem anyway.

A more rational reaction would be:

• make sure that your users are using good passwords which are hard to guess/brute-force
• disable password-authentication (at least for important accounts) and just use public-key-authentication
• watch out for ssh-security issues and upgrades

Answer 3

Changing the SSH port is mostly security theater. It gives you a fuzzy feeling of having done something. You've hidden the SSH port under the doormat.

If you run an SSH server on the Internet, you'll see a lot of failed login attempts in your logs, from bots that are looking for stupidly weak passwords, weak keys and known exploits in server older versions. The failed attempts are just that: failed attempts. As far as evaluating how vulnerable you are, they are completely irrelevant. What you need to worry about is the successful intrusion attempts, and you won't see those in your logs.

Changing the default port will reduce the number of hits by such bots, but that only foils the least sophisticated attackers who are stopped by any decent security (security updates applied regularly, reasonably strong passwords or disabled password authentication). The only advantage is reducing the volume of logs. If that is an issue, consider something like Denyhosts or Fail2ban to limit the connection rate instead, it'll also do your bandwidth good.

Changing the default port has a major disadvantage: it makes you less likely to be able to log in from behind a firewall. Firewalls are more likely to let services through on their default port than on some random other port. If you aren't running an HTTPS server, consider making SSH listen on port 443 as well (or redirect incoming TCP requests from port 443 to port 22), as some firewalls allow traffic that they can't decode on port 443 because it looks like HTTPS.