ssh change port to dynamic range

adamus007p · Jul 14, 2020

Hello, using 16 option I can change the default SSH port 22 to new one.

There is info:
New SSH port should be a number below and less than <1024.

should be or must be?

Can I use higher port then 1024 like 34567 or something?

Jay Chen · Jul 14, 2020

I never use that option before, I always edit the sshd_config, and I changed the port to a number bigger than 1024.
Not sure if this is a good idea, but I didn't ran into any issue, or not yet.

adamus007p · Jul 14, 2020

Let's ask @eva2000 May you advise?

eva2000 · Jul 14, 2020

ideally <1024

adamus007p · Jul 14, 2020

@eva2000 if there would be problem when I can to choose higher port like 43432 or something?

eva2000 · Jul 14, 2020

adamus007p said: ↑

@eva2000 if there would be problem when I can to choose higher port like 43432 or something?
Click to expand...

best to use below 1024 see answer at https://unix.stackexchange.com/questions/582857/ssh-best-practice-with-a-privileged-port

but what's the difference if I change it to 483 vs. 2022

Almost none, except that all SSH clients that I know - OpenSSH, Putty, dbclient will try to use port 22 by default so you will have to provide a port number manually when connecting to a host using a non-standard port but as you can save port number in a config it's a one-time job. And from a practical standpoint, some people prefer setting SSH daemon to listen on port 80 or 443 to pretend HTTP or HTTPS respectively so that SSH connections will not be blocked by overzealous firewalls in hotels, airports etc.

in regards to the above note? Regardless of what port I change it to, anyone can still SSH to that port.

I think that by Anyone can use the unprivileged ports of 1024 and greater. they meant that local non-root users can use non-privileged ports for their services. It's not about connecting to the services listening on a given port from outside, it's about directing local services to use that port. As to why do they recommend using a privileged port for SSH service - the reason is that:

The TCP/IP port numbers below 1024 are special in that normal users are not allowed to run servers on them. This is a security feaure, in that if you connect to a service on one of these ports you are fairly sure that you have the real thing, and not a fake which some hacker has put up for you.

(from PrivilegedPorts -- /User)

To expand on it further - as discussed in these comments on ServerFault:

It is precisely the reason you shouldn't run privileged daemons on ports above 1023. Any user (local or remote) can DDoS it until it crashes, then a local user (i.e. PHP, Apache, MySQL, anything that has a remote execution vulnerability) can start its own daemon on the same port and then wait for you to connect.
Click to expand...

adamus007p · Jul 14, 2020

Thank you for the explanation

adamus007p · Jul 15, 2020

So when I have VPS and I am only one user and root account is it also dangerous to have bigger number of port?

eva2000 · Jul 15, 2020

yes

Log in / Register

Forums

Get the most out of your Centmin Mod LEMP stack

ssh change port to dynamic range

adamus007p Member

Jay Chen Active Member

adamus007p Member

eva2000 Administrator Staff Member

adamus007p Member

eva2000 Administrator Staff Member

adamus007p Member

adamus007p Member

eva2000 Administrator Staff Member

.

Log in / Register

Useful Searches

Get the most out of your Centmin Mod LEMP stack

ssh change port to dynamic range

adamus007p Member

Jay Chen Active Member

adamus007p Member

eva2000 Administrator Staff Member

adamus007p Member

eva2000 Administrator Staff Member

adamus007p Member

adamus007p Member

eva2000 Administrator Staff Member

.