<story><title>Moving your SSH port isn’t security by obscurity</title><url>https://danielmiessler.com/blog/no-moving-your-ssh-port-isnt-security-by-obscurity/</url></story><parent_chain><item><author>nmaludy</author><text>An FBI agent from the Cyber Crimes division gave a talk while I was in college (&amp;gt;10 years ago). He was interested in brute force attacks against SSH daemons and created a couple hypotheses around number of logins and common passwords. To test this he setup two Honey Pot to record all of the username&amp;#x2F;passwords. The first one listened on standard SSH port 22, the other listened on a random high-numbered port. He left both of these running for ~6 months.&lt;p&gt;Results:
The honey pot listening on standard port 22 received 1,000s of login attempts (sorry, don&amp;#x27;t remember the exact number).  The honey pot listening on the random high-numbered port received exactly 0.&lt;p&gt;I know this is just an anecdote and it might not necessarily be true today, but this experiment always sticks in my head. At least the guy used the scientific method: created a hypothesis, conducted the experiment, analyzed his results.</text></item></parent_chain><comment><author>wvenable</author><text>What I&amp;#x27;ve found these days monitoring my own network is that there is now 2 waves -- a port scan and then the attack.&lt;p&gt;If I change a port for anything to another random port I won&amp;#x27;t get any login attempts for a few days but eventually I start getting hit again.  I can repeat this over and over.  I imagine what is happening is that the bad actors are scanning for open ports and they feed that periodically to another process that attempts logins.</text></comment>
<story><title>Moving your SSH port isn’t security by obscurity</title><url>https://danielmiessler.com/blog/no-moving-your-ssh-port-isnt-security-by-obscurity/</url></story><parent_chain><item><author>nmaludy</author><text>An FBI agent from the Cyber Crimes division gave a talk while I was in college (&amp;gt;10 years ago). He was interested in brute force attacks against SSH daemons and created a couple hypotheses around number of logins and common passwords. To test this he setup two Honey Pot to record all of the username&amp;#x2F;passwords. The first one listened on standard SSH port 22, the other listened on a random high-numbered port. He left both of these running for ~6 months.&lt;p&gt;Results:
The honey pot listening on standard port 22 received 1,000s of login attempts (sorry, don&amp;#x27;t remember the exact number).  The honey pot listening on the random high-numbered port received exactly 0.&lt;p&gt;I know this is just an anecdote and it might not necessarily be true today, but this experiment always sticks in my head. At least the guy used the scientific method: created a hypothesis, conducted the experiment, analyzed his results.</text></item></parent_chain><comment><author>Twirrim</author><text>Anecdotally, I have a machine with an exposed SSH, on a high number port.  I get brute force attempts on a regular basis against it, just way less than when I run it on the standard port number.  Security by obscurity is just one part of the steps I take with that machine.  Using a high port number is dead simple and easily handled client side too, so I just do it.</text></comment>