Why do you expose port 22 to the entire internet? Limit it to your own IP addresses and/or only allow access through your Wireguard/VPN ranges. Then changing the default port becomes meaningless.
Comment on What else should I do for my home server security?
StateMachine@lemmy.zip 3 weeks agoAnd move SSH to a non-default port. Without that, my public-facing servers get thousands of SSH attacks a day, and it basically goes to zero after moving it to a random-looking high port.
Also, totally agree with using public key login and disable password login.
Thaurin@lemmy.world 2 weeks ago
possiblylinux127@lemmy.zip 3 weeks ago
OpenSSH rate limits authentication attempts so it isn’t a big deal.
That’s generally good advice but not actually security related.
Removing all the stress on your ressources by using a non-standard port is good for your ressources, But those automated scanners looking for unsecured devices and trying out password like admin/admin are not actually a risk. It’s just a case of security by obscurity and never actually serves its purpose.
gastroglizzy@piefed.social 3 weeks ago
Very true. There are only ~65K ports. If someone decides they want to, trying all of them to see which one gives a valid response is trivial.
foggy@lemmy.world 3 weeks ago
Literally a single nmap command will tell me where you “hid” your ssh port.
Like the poster you’re responding to said, it is good advice but not for security. It takes you off the hacker spam list, essentially.