<p dir="ltr">Unless you are being specifically, there are about 60,000 ports that aren't scanned by tools in default mode. High numbers without registered services will get almost zero hits.</p>
<div class="gmail_quote">On Feb 16, 2014 3:45 PM, "John Heim" <<a href="mailto:john@johnheim.com">john@johnheim.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
<br>
My experience is that changing the port reduces the random attempts to near zero. But if someone specifically targets you, it doesn't help.<br>
<br>
Hackersprobably aren't doing port scans of your server. They are probably scanning your network for machines with port 22 open.<br>
<br>
On 02/16/14 13:20, Edward Holcroft wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
All,<br>
<br>
I have a server that I had to open to the world for ssh. It's getting a<br>
lot of brute-force hits, although I've managed to bring it down to an<br>
"acceptable" level by using a suitable level of paranoia in denyhosts.<br>
Obviously I'd rather not have these hits at all.<br>
<br>
I often hear the suggestion made that I should be using a non-standard<br>
port for ssh to reduce such attacks. I wonder though what the real value<br>
of this would be, since would a portscan not reveal the open port to<br>
would-be hackers anyway?<br>
<br>
I've heard it said that unwanted ssh hits have been reduced to zero by<br>
changing the port from 22 to something else. Of course I can test the<br>
hypothesis by simply changing the port, but I'd like to hear some<br>
opinions on this question before doing so.<br>
<br>
ed<br>
<br>
--<br>
Edward Holcroft | Madsen Kneppers & Associates Inc.<br>
11695 Johns Creek Parkway, Suite 250 | Johns Creek, GA 30097<br>
O <a href="tel:%28770%29%20446-9606" value="+17704469606" target="_blank">(770) 446-9606</a> | M <a href="tel:%28770%29%20630-0949" value="+17706300949" target="_blank">(770) 630-0949</a><br>
<br>
MADSEN, KNEPPERS & ASSOCIATES USA, MKA Canada Inc.<br>
WARNING/CONFIDENTIALITY NOTICE: This message may be confidential and/or<br>
privileged. If you are not the intended recipient, please notify the<br>
sender immediately then delete it - you should not copy or use it for<br>
any purpose or disclose its content to any other person. Internet<br>
communications are not secure. You should scan this message and any<br>
attachments for viruses. Any unauthorized use or interception of this<br>
e-mail is illegal.<br>
<br>
<br>
______________________________<u></u>_________________<br>
Ale mailing list<br>
<a href="mailto:Ale@ale.org" target="_blank">Ale@ale.org</a><br>
<a href="http://mail.ale.org/mailman/listinfo/ale" target="_blank">http://mail.ale.org/mailman/<u></u>listinfo/ale</a><br>
See JOBS, ANNOUNCE and SCHOOLS lists at<br>
<a href="http://mail.ale.org/mailman/listinfo" target="_blank">http://mail.ale.org/mailman/<u></u>listinfo</a><br>
<br>
</blockquote>
______________________________<u></u>_________________<br>
Ale mailing list<br>
<a href="mailto:Ale@ale.org" target="_blank">Ale@ale.org</a><br>
<a href="http://mail.ale.org/mailman/listinfo/ale" target="_blank">http://mail.ale.org/mailman/<u></u>listinfo/ale</a><br>
See JOBS, ANNOUNCE and SCHOOLS lists at<br>
<a href="http://mail.ale.org/mailman/listinfo" target="_blank">http://mail.ale.org/mailman/<u></u>listinfo</a><br>
</blockquote></div>