I've noticed lot of admins change default ssh port. Is there any rational reason to do so?
The most likely reason is to make it harder for people randomly trying to brute force any SSH login they can find. My internet-facing machine uses the default SSH port, and my logs used to be filled with stuff like this (excerpted from an actual log file):
sshd: Invalid user test from 220.127.116.11 sshd: Invalid user oracle from 18.104.22.168 sshd: Invalid user backup from 22.214.171.124 sshd: Invalid user ftpuser from 126.96.36.199 sshd: Invalid user nagios from 188.8.131.52 sshd: Invalid user student from 184.108.40.206 sshd: Invalid user tomcat from 220.127.116.11 sshd: Invalid user test1 from 18.104.22.168 sshd: Invalid user test from 22.214.171.124 sshd: Invalid user cyrus from 126.96.36.199 sshd: Invalid user temp from 188.8.131.52 sshd: Invalid user postgres from 184.108.40.206 sshd: Invalid user samba from 220.127.116.11
These days I use DenyHosts to block IPs that fail to authenticate too many times, but it's probably just as easy to just switch ports; virtually all brute force attacks of this kind aren't going to bother scanning to see if your sshd is listening on another port, they'll just assume you're not running one and move on
No, it's a security by obscurity tactic.
If your sshd setup is not fit enough to face dumb script kiddies only trying port 22, you have a problem anyway.
A more rational reaction would be:
- make sure that your users are using good passwords which are hard to guess/brute-force
- disable password-authentication (at least for important accounts) and just use public-key-authentication
- watch out for ssh-security issues and upgrades
Some people may also be annoyed by the noise sshd writes into the system log, e.g.:
Jan 02 21:24:24 example.org sshd: Invalid user guest from 18.104.22.168 Jan 02 21:24:24 example.org sshd: input_userauth_request: invalid user guest [preauth] Jan 02 21:24:24 example.org sshd: error: Received disconnect from 22.214.171.124: 3: com.jcraft.jsch.JSchException: Auth fail [preauth] Jan 02 21:24:24 example.org sshd: Invalid user ubnt from 126.96.36.199 Jan 02 21:24:24 example.org sshd: input_userauth_request: invalid user ubnt [preauth] Jan 02 21:24:24 example.org sshd: error: Received disconnect from 188.8.131.52: 3: com.jcraft.jsch.JSchException: Auth fail [preauth
It might be then tempting to obscure the sshd port or to use an automatic blocking solution (like DenyHosts, Fail2ban or BlockHosts) in order to increase the signal-to-noise ratio again.
But better alternatives do exist. For example, you can configure your syslog daemon such that the sshd log noise is only written to - say -
/var/log/sshd-attempts.log and the signal (i.e. the remaining sshd log messages) is written to
/var/log/messages etc. as before.
The deployment of automatic blocking tools should be considered carefully because adding more complexity to security relevant systems means also increasing the risk of exploitation. And indeed, over the years, there are several DoS vulnerability reports for each DenyHosts, Fail2ban and BlockHosts.
Changing the SSH port is mostly security theater. It gives you a fuzzy feeling of having done something. You've hidden the SSH port under the doormat.
If you run an SSH server on the Internet, you'll see a lot of failed login attempts in your logs, from bots that are looking for stupidly weak passwords, weak keys and known exploits in server older versions. The failed attempts are just that: failed attempts. As far as evaluating how vulnerable you are, they are completely irrelevant. What you need to worry about is the successful intrusion attempts, and you won't see those in your logs.
Changing the default port will reduce the number of hits by such bots, but that only foils the least sophisticated attackers who are stopped by any decent security (security updates applied regularly, reasonably strong passwords or disabled password authentication). The only advantage is reducing the volume of logs. If that is an issue, consider something like Denyhosts or Fail2ban to limit the connection rate instead, it'll also do your bandwidth good.
Changing the default port has a major disadvantage: it makes you less likely to be able to log in from behind a firewall. Firewalls are more likely to let services through on their default port than on some random other port. If you aren't running an HTTPS server, consider making SSH listen on port 443 as well (or redirect incoming TCP requests from port 443 to port 22), as some firewalls allow traffic that they can't decode on port 443 because it looks like HTTPS.