RE: [gentoo-hardened] Hardening SSHD

> I've seen many recommendations for port knocking, but I feel that's
> unnecessarily complex when compared to simply changing the port sshd
> listens on. While the use of port knocking no doubt further decreases
> your exposure over an alternate sshd port, the difference is only a
> small percentage of the benefit you receive from moving away from port
> 22 in the first place.

I've moved most of my public SSH ports off 22 because it reduces by
thousandfolds the script kiddies playing with their toys and filling my logs
and pipes. There is no more efficient means that will give you such returns
with such little effort.

I only wish I'd done it sooner. Yeah, you'll still get port scanned and
someone will snoop around, but that's not in the face of the storm on port
22.
-- 
gentoo-hardened@g.o mailing list