Changing the ssh port

Changing the SSH port is an effective way to protect against bot attacks. Find out how to change the default port and increase your server's security.

ssh bezpieczeństwo 

Sep 17 22:33:36 mail sshd[16193]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=arpanet.net  user=root
Sep 17 22:33:38 mail sshd[16193]: Failed password for root from 185.66.120.10 port 51927 ssh2
Sep 17 22:33:46 mail sshd[16193]: Failed password for root from 185.66.120.10 port 51927 ssh2
Sep 17 22:33:50 mail sshd[16193]: Failed password for root from 185.66.120.10 port 51927 ssh2
Sep 17 22:33:50 mail sshd[16193]: Connection closed by 185.66.120.10 [preauth]

The logs above point to failed attempts to log in to the root account, in 90% of cases by bots. This situation is perfectly acceptable for people who:

  • are able to create a strong password
  • the rest of the users have strong passwords (but that's already a risky assumption)
  • point one + we have no other users

In any other case we should take steps to limit brute-force password cracking on our server. The simplest and, admittedly, effective solution is changing the default ssh port, since basically all malicious bots connect via the default ssh port, i.e. 22.

In the file: /etc/ssh/sshd_config we locate the line Port 22 and change it to a port above 1024 (range 1025 - 65535).
When choosing an appropriate port, it's good to first check whether that port is already in use. There are several ways to do this, here's one of them: 

root ~ # netstat -tuln
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 151.101.65.5:53         0.0.0.0:*               LISTEN
tcp        0      0 127.0.0.1:53            0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN
tcp        0      0 127.0.0.1:953           0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN
tcp        0      0 127.0.0.1:9000          0.0.0.0:*               LISTEN
tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN
tcp        0      0 127.0.0.1:9007          0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN
tcp6       0      0 :::22                   :::*                    LISTEN
tcp6       0      0 ::1:953                 :::*                    LISTEN
udp        0      0 151.101.65.5:53         0.0.0.0:*
udp        0      0 127.0.0.1:53            0.0.0.0:*

If we use a firewall (e.g. iptables), we need to allow traffic on this port. After making the changes in the ssh configuration file, we restart the service.

When changing the port, I don't recommend setting it to 2222, which is very popular both among administrators and among unfriendly (hostile) applications.

Changing the ssh port isn't a complete security measure - we're really only reducing brute-force attack attempts. There are also cases where it's hard to change the port, for instance due to user habits or the use of software that relies on the ssh protocol, in which case we'd have to make corresponding changes everywhere.

If sticking with the standard port, a good idea is to limit failed login attempts, e.g. using fail2ban.