As said above, changing a version number is
- Hard to do
- Security through obscurity
- Not flexible
What I suggest is implementing Port Knocking.
It's a fairly simple technique to hide anything that is running on your server.
Here is a good implementation:
This is how I implemented it on my servers (other numbers) to open SSH only to the people who know 'the secret knock':
sequence = 300,4000,32
seq_timeout = 5
command = /opencloseport.sh %IP% 2305
tcpflags = syn
This will give a 5 sec window in which the 3 SYN-packets need to be received in the right order. Choose ports that are far from each other and not sequential. That way, a portscanner can't open the port by accident.
These ports do not need to be opened by iptables.
The script I call is this one. It opens a particular port for 5 seconds for the IP sending the SYN-packets.
/sbin/iptables -I INPUT -s $1 -p tcp --dport $2 -j ACCEPT
/sbin/iptables -D INPUT -s $1 -p tcp --dport $2 -j ACCEPT
It can be a real pain to send the SYN-packets so I use the script to connect to the SSH of my servers:
knock $1 $2
knock $1 $3
knock $1 $4
ssh $5@$1 -p $6
(It's pretty obvious what is happening here...)
After the connection is established, the port can be closed.
Hint: Use Key-authentication. Otherwise you need to be very fast to type your password.