27
[Question] about the security basics
(lem.ainyataovi.net)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 11 Jul 2023
27 points (96.6% liked)
Selfhosted
39700 readers
681 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 1 year ago
MODERATORS
Changing the port seems like a pointless step, just disallow access from everywhere and allow only from select IPs. Port scanners will scan all open ports and will detect that it's ssh, regardless of port number.
Agreed. Security through obscurity is a fallacy.
If OP just wants to use it himself, a good idea might be to setup a VPN service and only allow the other services to be used from the VPN. That can be done with wire guard and a reverse proxy for example.
While I do completely agree, changing ports is more about getting rid of low-hanging fruit so some script kiddie doesn't get into 22. But again I do agree with everything you said.
Just firewall the port and there's no difference for your hypothetical script kiddies. Don't ever do security by obscurity.
Of you have Skript kiddies logging in successfully on 22, you have way different problems.
Of course, changing a port number is not a good security improvement even in the realm of security through obscurity.
Changing the default port isn’t any more secure, but you’ll cut down on access attempts which will take some load off of your VM. It’s something that could be worth doing if you’re running a very cheap VPS.
It's well worth it for this reason alone. Unless you're running a honeypot, getting that noise out of your access logs can provide more actionable data to work with for more persistent threats.