Actually, this works for a practical reason: scanning ports takes time and resources, and script kiddies are more likely to move on to the next target if they don't find a worthwhile target in the first few thousand ports. It won't help against a determined attacker, of course, but it does reduce the number of less-skilled attacks.
If there is a 0-day or unreleased SSH vulnerability, your login security doesn't matter. In those cases, it helps if the s'kiddies skipped your site altogether because they couldn't be bothered to wait to find where your ssh port is.
Comments
Actually, this works for a practical reason: scanning ports takes time and resources, and script kiddies are more likely to move on to the next target if they don't find a worthwhile target in the first few thousand ports. It won't help against a determined attacker, of course, but it does reduce the number of less-skilled attacks.
People keep mentioning this, and I really don't understand why.
Do you have a username/password or username+certificate that a script kiddy is likely to hit in their first 10,000 attempts?
If yes, you have a much larger problem that can't be solved by port knocking or moving ssh to a different port.
If not, then you're trying to solve a problem which doesn't exist anyway.
If there is a 0-day or unreleased SSH vulnerability, your login security doesn't matter. In those cases, it helps if the s'kiddies skipped your site altogether because they couldn't be bothered to wait to find where your ssh port is.
Ah, thanks. That's a big if, but it has happened, so it makes some sense.