back

by _tk_·6y ago·view on hn ↗
To maybe give some perspective _why_ security people say that security by obscurity is bad - and especially serving ssh via port 64323:

Typically you want to know who is connecting to what server via what service and log these connections. If something is off, an alert can be generated. If ssh isn't served on a standardized port, logging and alerting becomes more complicated - albeit not impossible.

There is more housekeeping to do. In case of a handoff, things like this need to be documented. If all services work on their default port, there is no need for documenting them.

In the case of compromise, it becomes very hard to identify how a machine got compromised.

Yes, a lot of people do not do a full port scan. But those are not the people exploiting risky vulnerabilities. Security by obscurity reduces your risk, but only to a certain extent. Having a proper patch management or firewall management in place reduces your risk a lot more.

A lot of owls do get killed by humans, despite their camouflage.

1 comments
> Typically you want to know who is connecting to what server via what service and log these connections. If something is off, an alert can be generated. If ssh isn't served on a standardized port, logging and alerting becomes more complicated - albeit not impossible.

Could you elaborate on that? I serve ssh on a non-standard port precisely in part because it drastically cut down on the noise of failed log-ins, to the point where when I check the logs I'm almost the only one who actually bothers to try to log in via that port. That seems like a win to me.

Not the OP but I assume what they mean is that if you have network-wide monitoring across a network with lots of servers then it won't be able to easily make sense of what is happening if servers are all using non-standard ports for things.
Correct. This is an argument made from a corporate network perspective.