• @[email protected]
    link
    fedilink
    English
    27 months ago

    Imagine that the xz exploit actually made it into your server, so your sshd was vulnerable. Having it on another port does seem helpful then.

    Nope. Your entire server can be scanned in less than a second for an open ssh port.

    IPv6 does not change the fact since when your server is attacked the hist IP is already known.

    • @solrize
      link
      English
      27 months ago

      Maybe I’m missing something but how is the host ip known? The server has a maybe-known range of addresses, but I don’t announce which address has an sshd listening. There are 2**64 addresses in the range, so scanning in 1 second doesn’t sound feasible.

    • Possibly linux
      link
      fedilink
      English
      1
      edit-2
      7 months ago

      I’ve never seen an attack that scans all ports. Normally it just checks open ports and then tries common credentials and exploits. If that fails it moves on to the next IP.

      Changing the default port on SSH probably isn’t going to do much as SSH is already pretty secure. However it is a good rule of thumb to change the defaults.