[kudumi]

I have a remote server that I access it via ssh. As I have seen many attempts to hack into, I disabled pass login, configured allowed host ip.

I want to change the default ssh port but a port scan (nmap) will tell the hacker about my open ssh port!!

so is there anyway to prevent port scanning (router has opening port at 22 and it forwards the ssh service to xx port number)? so that a hacker never finds my open port number. If one can do this then please provide me more detail, thanks

[dropzon3]

You can't 'stop' it but you can detect it and ban. I use the following iptables rules(got them from Google awhile ago; I didn't write them)

Code:

iptables -A INPUT -m recent --name portscan --rcheck --seconds 86400 -j DROP iptables -A FORWARD -m recent --name portscan --rcheck --seconds 86400 -j DROP # Once the day has passed, remove them from the portscan list iptables -A INPUT -m recent --name portscan --remove iptables -A FORWARD -m recent --name portscan --remove # These rules add scanners to the portscan list, and log the attempt. iptables -A INPUT -p tcp -m tcp --dport 139 -m recent --name portscan --set -j LOG --log-prefix "Portscan:" iptables -A INPUT -p tcp -m tcp --dport 139 -m recent --name portscan --set -j DROP iptables -A FORWARD -p tcp -m tcp --dport 139 -m recent --name portscan --set -j LOG --log-prefix "Portscan:" iptables -A FORWARD -p tcp -m tcp --dport 139 -m recent --name portscan --set -j DROP

What it does is it looks for someone trying to connect to port 139(NetBIOS) and bans them for a day if they try to connect to the port. Of course I never run anything on that port but its almost certainly going to be scanned by any automated scanner as its a dangerous port that is frequently open and exposes sensitive content on Windows machines.

Another thing to consider is the concept of port knocking(install knockd) which is a security by obscurity but not necessarily a bad idea. Basically it requires you 'knock' on a series of ports in the correct order, once you've done so it will open up the port(or run w/e command you want)

That said simply moving your SSH off the default port 22 will stop the majority of automated attacks(which is likely what you're encountering).

[The Real Slim Shady]

You cant prevent a portscan. Thats just stupid. You can make a portscan ineffective, but thats about it.

For extreme protection - I would recommend you google Portknocking. Im not gonna post an in depth tutorial because there are already plenty on Google.

But essentially, You block all the ports you want blocked with a firewall. Using an application or custom crafted rules, you then have the port opened in the firewall for your IP/session if and only if you connect to a series of other ports first (also closed).

So for example, if you connected to ports 1111, 2222, 3333, 4444 - in that order - Port 22 will be opened for you. Wont be accessible to anyone else however.

[Volenar]

Indeed. It is not possible to stop port scanning. You can only show the ports you have open, as closed.

[TheMind]

Awesome info

[The Real Slim Shady]

Indeed. It is not possible to stop port scanning. You can only show the ports you have open, as closed.

You cant "show" them as closed. You can only close them, or open them. If they are open they are open.

[Ex094]

Well as geoff said, there's no solution for this but what you can do is to create a Honeypot or use Iptables to filter incoming connections. What honeypots do is basically create virtual open ports and when anyone connects to them the IP gets added to the blacklist so they can connect later on.

Take a look at this IPTables tutorial http://www.cyberciti.biz/faq/iptables-block-port/

[gm09519]

use honeypots.......

[DarkCyan1337]

Well, one of the simplest ways to do it more or less effectuvely is to listen on random ports and block ip addresses that are trying to connect there. Well, thats could sound too much primitive, but it works de facto in most of cases.

[Kaiten]

You can't actually block port scanners, this is because open ports need to allow incoming connections or they would be pointless.
However, you may install a firewall or use IPtables to detect and ban IP addresses that attempt to connect to multiple ports in a certain time frame.