Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

>you block port 22 and use iptables to redirect a random high port to port 22, you'll never see any connection attempts

This is a really bad idea, stick to lowports. Despite SSH doing host authentication, you really don't want non-root users being able to hijack the sshd port.



If they are using iptables to do the redirect instead of changing sshds port, wouldn't an attacker need a way to change/disable iptables, which also requires root? There shouldn't be a way for an application to put itself in front of iptables.


Ah! You're right, I didn't think that through. iptables is indeed a safe way to do this, however changing your port in the configs to a highport isn't.




Consider applying for YC's Fall 2026 batch! Applications are open till July 27.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: