I've noticed lot of admins change default ssh port. Is there any rational reason to do so?
The most likely reason is to make it harder for people randomly trying to brute force any SSH login they can find. My internet-facing machine uses the default SSH port, and my logs used to be filled with stuff like this (excerpted from an actual log file):
These days I use DenyHosts to block IPs that fail to authenticate too many times, but it's probably just as easy to just switch ports; virtually all brute force attacks of this kind aren't going to bother scanning to see if your sshd is listening on another port, they'll just assume you're not running one and move on
No, it's a security by obscurity tactic.
If your sshd setup is not fit enough to face dumb script kiddies only trying port 22, you have a problem anyway.
A more rational reaction would be:
Some people may also be annoyed by the noise sshd writes into the system log, e.g.:
It might be then tempting to obscure the sshd port or to use an automatic blocking solution (like DenyHosts, Fail2ban or BlockHosts) in order to increase the signal-to-noise ratio again.
But better alternatives do exist. For example, you can configure your syslog daemon such that the sshd log noise is only written to - say -
The deployment of automatic blocking tools should be considered carefully because adding more complexity to security relevant systems means also increasing the risk of exploitation. And indeed, over the years, there are several DoS vulnerability reports for each DenyHosts, Fail2ban and BlockHosts.
Changing the SSH port is mostly security theater. It gives you a fuzzy feeling of having done something. You've hidden the SSH port under the doormat.
If you run an SSH server on the Internet, you'll see a lot of failed login attempts in your logs, from bots that are looking for stupidly weak passwords, weak keys and known exploits in server older versions. The failed attempts are just that: failed attempts. As far as evaluating how vulnerable you are, they are completely irrelevant. What you need to worry about is the successful intrusion attempts, and you won't see those in your logs.
Changing the default port will reduce the number of hits by such bots, but that only foils the least sophisticated attackers who are stopped by any decent security (security updates applied regularly, reasonably strong passwords or disabled password authentication). The only advantage is reducing the volume of logs. If that is an issue, consider something like Denyhosts or Fail2ban to limit the connection rate instead, it'll also do your bandwidth good.
Changing the default port has a major disadvantage: it makes you less likely to be able to log in from behind a firewall. Firewalls are more likely to let services through on their default port than on some random other port. If you aren't running an HTTPS server, consider making SSH listen on port 443 as well (or redirect incoming TCP requests from port 443 to port 22), as some firewalls allow traffic that they can't decode on port 443 because it looks like HTTPS.