Re: SSH attacks?

[mgotts () 2roads com]

> > If you are so worried about SSH security who don't you just run sshd 
on
> > a non-standard port.
>
>    That practice affords no security benefit.  Any scanner worth its
> salt (no pun...really) can identify a service even if it's running on a
> non-standard port.  Nessus does this, as do a host of other scanners.

It certainly does afford a security benefit.

The issue isn't whether or not there are tools that can identify a service 
on a nonstandard port (as you note, such tools are readily available). The 
issue -- especially in this case -- is that such scanning of all 65535 
ports is not being done by the worms and other automated attack tools 
being discussed. These sorts of attacks are going after the low-hanging 
fruit, the easy exploit and, if a worm, frequently looking for rapid 
infection rates. Scanning every port doesn't provide enough benefit to the 
attacker to be useful, especially considering that you can argue that 
anybody who bothers to change the port probably is also at least minimally 
aware of security.

Is it *good* security? No. Will an attacker who is specifically trying to 
penetrate your network be stopped? Of course not. But will it prevent a 
worm from zapping you in a day-0 exploit and give you time to patch or 
disable the service? Yes.

Had you said "little security benefit", I'd agree. But to say "no security 
benefit" is just silly.

-- Mark