[svlug] ssh attacks - ideas

[James Sparenberg]

On Fri, 2004-10-22 at 14:36, Rafael Skodlar wrote:
> On Fri, Oct 22, 2004 at 02:18:47PM -0700, Anthony Ettinger wrote:
> > What difference does the port make? I don't see how
> 
> Exactly. NMAP can tell you that some other port has ssh listening on it 
> if somebody decides to scan you on all kinds of ports.

the only thing I can think of is ensuring you don't pick a port that is
in use by something else you need.  Other than that... I'm equally at a
loss.

James

> 
> > this has any baring on whehter or not your machine is
> > secure.
> > 
> 
> If your level of paranoia is so high, then firewall ports so that
> connections are limited to certain sources. If that's not acceptable, I
> have my doubts in it's practicality, then use port knocking technique to
> open default ssh port only when needed.
> 
> > --- Norman Shapiro <norm at dad.dad.org> wrote:
> > 
> > > "Edward M. Goldberg" <emg at EdwardMGoldberg.com>
> > > writes
> > > 
> > > >Pick [the port that sshd will listen to] with care!
> > > 
> > > Can you tell me what to be careful about?  How do I
> > > pick the port?  Is there
> > > some appropriate range?
> > > 
> > > Thanks for being patient with my stupidity. 
> > > 
> > >     Norman Shapiro
> > >     798 Barron Avenue
> > >     Palo Alto CA 94306-3109
> > >     (650) 565-8215
> > >     norm at dad.org