this post was submitted on 20 Apr 2024
135 points (98.6% liked)

Selfhosted

40183 readers
1201 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 10 points 6 months ago (14 children)

Moving ports does help. It is not a sure thing but when used in conjunction with other security mechanism can help get rid the of the low hanging fruit of scriptkiddies and automated scans.

[–] [email protected] 9 points 6 months ago (7 children)

But scriptkiddies and automated scans are not a security threat. If they were a legitimate threat to your server, you have bigger problems.
All it does is reduce log chatter.

Anyone actually wanting in would port scan, then try and connect to each port, and quickly identify an SSH port

[–] [email protected] 4 points 6 months ago (5 children)

Imagine that the xz exploit actually made it into your server, so your sshd was vulnerable. Having it on another port does seem helpful then. In fact i sometimes think of putting mine on a random secret address in the middle of a /64 ipv6 range, but I haven't done that yet.

it occurs to me, the xz exploit and similar is a good reason not to run the latest software. It affected Debian Sid but not the stable releases. I'm glad I only run the stable ones.

[–] [email protected] 3 points 6 months ago

Just have 2 ipv4 assigned to your server. Have 1 for all your services, and run ssh on the other allowing root login with the password "admin".
A random ipv6 in the same subnet as your server is just obscurity.

The XZ exploit would be functionally similar to allowing root login using the password "admin".
Would doing that on a different port be secure? No? Then a different port is not security, it's obscurity.

Obscurity is just going to trip you up at some point and reduce log chatter.

And yes, running LTSB/stable is a sensible choice for servers.

load more comments (4 replies)
load more comments (5 replies)
load more comments (11 replies)