Leaving SSH on port 22 is in no way insecure. Putting it on another port isn't going to stop anyone from trying to bruteforce their way in via ssh. A simple port scan will reveal what port SSH is running on. A better solution is to ensure that you configure SSH in a secure manner - disable root login via ssh, disable password-based authentication completely (use a public-key/private-key pair instead), and use something such as fail2ban, which blocks inbound connections from IPs that have numerous failed login attempts. Security through obscurity is no security at all, in my book.
I would use public-key/private-key pair. However, I havent figured out how to do it though. Hehe.
The thing that makes me decided to change my ssh port is that there are people who have bots running to brute force those with the standard port with password-based authentication. It is much faster to do a brute force on standard ports than scanning an ip for open ports and then brute force. Changing the ssh port number is something for me to block off those script kiddies.
And Since I will be using xinetd to run dropbear upon ssh connection, that means if one is to try a login attempt; xinetd will create an instance of dropbear; CPU is utilized.
Of course changing ssh port number is just an addition thing like you said. It could never be estimated as a form of proper security measure. Just like when you bought an apple, you can eat them with or without washing the apple.
service dropbear
{
socket_type = stream
only_from = 0.0.0.0
wait = no
user = root
protocol = tcp
server = /usr/sbin/dropbear
server_args = -i
disable = no
port = 21413
}
This does not work. xinetd will not listen at all. However if you add a type = unlisted, then it will work. I would use the admin's solution; Much more cleaner.
This is the working xinetd script for dropbear that I have tested.
service dropbear
{
socket_type = stream
only_from = 0.0.0.0
wait = no
user = root
protocol = tcp
server = /usr/sbin/dropbear
server_args = -i
disable = no
port = 21413
type = unlisted
}
Thank you everyone for the great inputs! Helped me to learn a few things.
