[Loki123]

I was providing some additional suggestions.

4. It may not be necessary if he keeps his key secure. but what if it falls into the wrong hands? his computer hacked, accidentally uploaded to github... whatever. The fact is it is additional protection. Which is why I mentioned it.

5. The user would have to be able to kill that process. But if you're worried about requiring root to use the port - you could just as easily use 222 or 15 if you wanted to. no practical difference between 22 and 222. Again, its just security through obscurity but in the event a 0day hits the web it'll stop the skids scanning 22 for vulnerable services. definitely a + no matter how little security it actually provides. Which is why i mentioned it.

6. There is nothing wrong with showing that you're running an ssh service. Unless there is a vulnerability. or your key becomes compromised. In which case not knowing how to access the service or even being able to tell that there is one, is a decent security precaution. Which is why i mentioned it.

Whether the suggestions are reasonable or practical or not - there is valid reasoning/logic behind all of them. They will not detract from security in any way, and will infact likely increase it.

I do realize that you were only providing additional suggestions, I was trying to provide reasonable logic why he wouldn't need 2 of them or wouldn't want. Cons of those methods pretty much was all I was trying to do. But implemented correctly and they all serve their good purpose.

4. As said, if the key falls into the wrong hands, it should have a decent passphrase. Today, cracking a 12 character passphrase takes years if not longer (excluding clusters for this purpose which I doubt many 12 year old kids using RAT's have access to) but instead of directly getting his hands on the password if his computer gets compromised he gains the key, but not the passphrase unless the admin uses the same passphrase everywhere, which is his own fault. Meaning you have two layers to bypass to gain access. Should be considered enough security. If he were to only use password, he might want that 2FA. But not saying the idea is wrong, just saying that the security currently exists could be considered enough security authentication vise. Of course it is logical to suggest it in here.

5. It isn't about being worried. It is more about not opening yourself to other variations of attacks. Thus; What good does it do to change the port to something that opens up a realistic and practical security risk ? That is all I am saying. Tl;dr; if changing the port, don't do it above 1024. Basically what I was trying to say.

6. I have nothing to say to this point.. Agreed pretty much.


Don't mistake my intentions for saying you are wrong or the idea/logic is wrong because it isn't. The intentions were simply to post the cons of one method (port 2222) that is frequently used and suggested. But everyone should be able to make their own decisions made up with the pros and cons, and I find the cons rarely posted in the port changing situation. But no idea or suggestion in your post is wrong at all.