In general, there are two main reasons why someone might want to run SSH listening on a high port:
- Since it's not the "standard" port, random attempts to break in (botnets) are less likely to connect to it
- If the port number is over 1024, the SSH daemon has one less "root privilege" it needs to be trusted with
Furthermore, if a NAT device sits in front of several servers running SSH, it can't map port 22 to all of them, so in that case it might be configured, for example, to redirect external port 10022 to internal service 192.0.2.10:22 and external port 11022 to 192.0.2.11:22.
However, in the case of Kippo, what you're installing is an "SSH honeypot", a program that is supposed to look like an SSH command line on a usable system but actually responds slowly and does nothing useful. You want to run that both on the regular SSH port (22) as well as on a frequently-used high port (2222); actually it's easier to run it as a user on the high port and then use
iptables to redirect the low port to the high port on the same host. It's also possible to use netcat (
nc) or xinetd to set up a redirect.
In order for Kippo to listen on the low port (either directly or via a redirect), the regular system SSH daemon can't already be listening there. Furthermore, in order to make your honeypot more believable, you don't want the system daemon listening on another "common" open port.
From a security standpoint it would be most effective to roll dice to pick that alternate port, but RDP is unlikely to be listening on a typical Linux server, so if you already remember that port number it might be fun to work with. Other "interesting" choices might be something like 5190 (AOL) or 1214 (KaZAA).