32

I am currently learning about installing Kippo SSH. From the tutorial, it said that I should reconfigure SSH port from 22 to a different port (which in this case 3389). So now whenever I try to SSH from a client, it will connect to port 3389.

From the tutorial, the reason behind this is that "we do not want Kippo to have root access".

My question being, what difference does it make running SSH from port 22 vs port 3389?

6
  • 8
    There is no concept of redirection in SSH, so I find a bit unclear what it is you are asking about. (I don't know whether that is because the tutorial you have been following is unclear, or if it is because you omitted some essential information while writing the question.)
    – kasperd
    Jan 14, 2016 at 17:20
  • 4
    Not an answer, but worth knowing: TCP port 3389 is often used for RDP. Perhaps 3389 was selected to try to be found by people who are scanning for remote access.
    – TOOGAM
    Jan 14, 2016 at 19:32
  • Which tutorial are you looking at... this one or this one or something else?
    – david
    Jan 16, 2016 at 11:54
  • @david i used this tutorial youtube.com/watch?v=OyBiIjrVXgk
    – Adam
    Jan 16, 2016 at 12:41

5 Answers 5

52

Most servers require root access if you want to open ports lower than 1024.

The TCP/IP port numbers below 1024 are special in that normal users are not allowed to run servers on them. This is a security feaure, in that if you connect to a service on one of these ports you can be fairly sure that you have the real thing, and not a fake which some hacker has put up for you.

See: https://www.w3.org/Daemon/User/Installation/PrivilegedPorts.html

1
  • 1
    I feel like this question relates well to this answer: superuser.com/questions/710253/… (Because after reading the answer, people are probably going to ask themselves that question) Jan 16, 2016 at 18:10
29

What difference does it make running SSH from port 22 vs port 3389?

In order to bind to a port below 1024 (a privileged port) a process must have root access. By making it bind to 3389 root access is not required.

0
21

One of the reasons I've seen this done, is to reduce log spam from password scanners. Then if someone's trying to bruteforce passwords, you know it's a targeted attempt rather than a driveby.

8

By redirecting SSH to a non standard port - you are making a hacker's life more difficult - because they will not be 100% sure which port you are using to access your system.

Port 22 - is the default port as you are aware. But if you have altered this to a non-standard port... I now need to go and carry out a port-scan using Nmap or some other tool to try and detect where the ssh server is now listening - this increases the chances of your IDS (Intrusion Detection System) of detecting this type of malicious behaviour - and can allow you to start to take counter-measures (such as denying the target's IP address).

Whilst it is true that to CREATE a listening port below 1024 you need root access - the sshd (the ssh daemon [server]) will have been started at boot time, and that alone will not stop priv/non-priv users from accessing the ssh process.

Should you wish to stop ssh for root - and this is always a good thing to stop. Then the ssh.config (It changes a little in its name depending on the OS being used - look however in /etc/ssh/ )

The value that controls if a root account can log in is

#PermitRootLogin no

This value and not the Port number - which by the way is configured using a value such as

#Port 22

Is how to restrict.

Ssh is a fantastic, flexible and secure communication mechanism - but only if understood and used correctly.

1
  • There's a difference between ssh allowing you to login as root and the ssh daemon itself needing root access to that it can open a privileged port. The question relates to the second of those two, not to the first.
    – Mike Scott
    Jan 17, 2016 at 10:31
3

In general, there are two main reasons why someone might want to run SSH listening on a high port:

  • Since it's not the "standard" port, random attempts to break in (botnets) are less likely to connect to it
  • If the port number is over 1024, the SSH daemon has one less "root privilege" it needs to be trusted with

Furthermore, if a NAT device sits in front of several servers running SSH, it can't map port 22 to all of them, so in that case it might be configured, for example, to redirect external port 10022 to internal service 192.0.2.10:22 and external port 11022 to 192.0.2.11:22.

However, in the case of Kippo, what you're installing is an "SSH honeypot", a program that is supposed to look like an SSH command line on a usable system but actually responds slowly and does nothing useful. You want to run that both on the regular SSH port (22) as well as on a frequently-used high port (2222); actually it's easier to run it as a user on the high port and then use iptables to redirect the low port to the high port on the same host. It's also possible to use netcat (nc) or xinetd to set up a redirect.

In order for Kippo to listen on the low port (either directly or via a redirect), the regular system SSH daemon can't already be listening there. Furthermore, in order to make your honeypot more believable, you don't want the system daemon listening on another "common" open port.

From a security standpoint it would be most effective to roll dice to pick that alternate port, but RDP is unlikely to be listening on a typical Linux server, so if you already remember that port number it might be fun to work with. Other "interesting" choices might be something like 5190 (AOL) or 1214 (KaZAA).

1
  • 1
    Without realising (or looking up) what Kippo is, it didn't make sense why an ssh daemon would not be root: if it wants to authenticate as any user, it has to keep some permissions to become a different user. But this answer makes it clear why it is important for it to be not run as root.
    – chexum
    Jan 16, 2016 at 13:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .