Changing SSH port of server. Simple yet effective security measure.
Any server you put on the Internet will be subject automated and targeted attacks. If you look at your auth.log file you would see that your servers are constantly scanned and attacked.
%99 of the attacks are automated and targeting standard ssh port (22).
Try this command on your server. You can change the date from Jan 5. to any other date.
root@testservice:/etc/ssh$ grep 'Jan 5' /var/log/auth.log | grep 'Invalid' | wc -l 298
Two of my server at home are through ssh accessible from Internet. They are both serving on the same IP number different ports.
On January 5th server that serving on standard ssh port received 298 login attempts and very same day one that serving on a non-standard ssh port received no failed login attempts at all.
As you can see changing your ssh port doesn’t cost you anything but, in return you get a cleaner log file. You know that if there is an failed login attempt on an non-standard ssh port. Somebody is focusing on you. You need pay attention and take counter measure.
In order to change port that your sshd service is listening you need to modify Port attribute in the /etc/ssh/sshd_config file.
Related posts:
You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.
