• emhl@feddit.org
    link
    fedilink
    English
    arrow-up
    0
    ·
    edit-2
    1 day ago

    Privileged ports can be used by processes that are running without root permissions. So if the sshd process would crash or stop for some other reason, any malicious user process could pretend to be the real ssh server without privilege escalation. To be fair this isn’t really a concern for single user systems. But setting up fail2ban or only making ssh accessible from a local network or VPN would probably be a more helpful hardenening step

    And regarding port 2222 it is the most popular non-provileged port used for SSH according to shodan.io So you ain’t gaining much obscurity

    • Laser@feddit.org
      link
      fedilink
      English
      arrow-up
      0
      ·
      1 day ago

      Privileged ports can be used by processes that are running without root permissions.

      I guess you mean unprivileged ports?

      So if the sshd process would crash or stop for some other reason, any malicious user process could pretend to be the real ssh server without privilege escalation.

      Not really, except on the very first connection because you need access to the root-owned and otherwise inaccessible SSH host key, otherwise you’ll get the message a lot of people have probably seen after they reinstalled a system (something like “SOMEONE MIGHT BE DOING SOMETHING VERY NASTY!”).