Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On a *nix system, when configuring ssh to listen on non standard port, should I also edit /etc/services to reflect that.

I would think it should be done, so tools that use it (such as ufw) will recognize the correct port for ssh, but I see very little mention of it in documentation and tutorials.

So is it considered good or bad practise to edit /etc/services, and if not, why?

share|improve this question
    
cyrusimap.org/~vanmeeuwen/imap/admin/… Guys from Cyrus seems to do it. I don't know what credit you would give to them though – pat Mar 5 at 15:25
    
@pat I imagine it's easier to get away with it for lmtp just based on how that protocol is used (locally, as the name implies). They also do document both approaches. – Håkan Lindqvist Mar 5 at 15:47
    
@HåkanLindqvist, you're right, I agree with your answer ! – pat Mar 5 at 18:20
    
I'm afraid this won't help that much- I get port scanners (scans open ports from 1 to 25565) a lot on my server, changing SSH port didn't lower the ssh brute force attempts that much. – ardaozkal Mar 5 at 18:34
    
@ardaozkal I doubt there is anybody port scanning all port numbers on all IPv4 addresses. Port scanning all port numbers on one IPv4 address or one port number on all IPv4 addresses is quite doable. Which means changing port number won't help much against a targeted attack. But if you are not a high profile target, then using a randomly chosen port number for ssh will usually eliminate all brute force attempts. I am not seeing any brute force attempts on hosts where I changed the ssh port. – kasperd Mar 6 at 10:28
up vote 12 down vote accepted

I don't think it makes sense to edit /etc/services in such a case. The world will not change ssh ports with you, and all programs that look up service names to port numbers on your machine would get the incorrect port for ssh.

If anything, it might make more sense to add an entry of your own for your non-standard ssh port, eg myssh <yourport>/tcp if you want a service name that you can use.


Then there's obviously the age-long debate of whether changing ports like that to "hide" services actually serves any real purpose beyond reducing log spam.

share|improve this answer
1  
Thanks @Håkan Lindqvist. Your answer is reasonable and useful. The only nit I would pick is that reducing log spam is a real security benefit. It allows one to better find the real information in the log. – Chen Levy Mar 5 at 17:40
    
Reducing spam is important if one must expose ssh to the internet. That makes parsing through alerts in a SIEM much easier so that the anomolies stick out more. – Aaron Mar 6 at 14:06

The file /etc/services contains the IANA assigned port numbers and there is not a single technical requirement to modify that file to be able to you run your services on a non-standard port. When you want a non-default port typically you can numerically set that port number in a service configuration file or with a start-up option.

I would also find it hard to diagnose why a service is not listening on its default port, when the non-standard port is not explicitly set in the start-up script or server configuration file, but taken from a modified /etc/services.

If you did change /etc/services to reflect your non-standard port number, please don't use an established service name such as ssh on your custom port as that might break connectivity when connecting to other system from yours.

You'll be hard-pressed to diagnose why ssh otherhost suddenly fails to connect when on that otherhost TCP/IP port 22 is open... .

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.