Comment on Three locks for your SSH doorparentComments−thaumaturgy16yPeople keep mentioning this, and I really don't understand why.Do you have a username/password or username+certificate that a script kiddy is likely to hit in their first 10,000 attempts?If yes, you have a much larger problem that can't be solved by port knocking or moving ssh to a different port.If not, then you're trying to solve a problem which doesn't exist anyway.−swombat16yIf there is a 0-day or unreleased SSH vulnerability, your login security doesn't matter. In those cases, it helps if the s'kiddies skipped your site altogether because they couldn't be bothered to wait to find where your ssh port is.−thaumaturgy16yAh, thanks. That's a big if, but it has happened, so it makes some sense.
Comments
People keep mentioning this, and I really don't understand why.
Do you have a username/password or username+certificate that a script kiddy is likely to hit in their first 10,000 attempts?
If yes, you have a much larger problem that can't be solved by port knocking or moving ssh to a different port.
If not, then you're trying to solve a problem which doesn't exist anyway.
If there is a 0-day or unreleased SSH vulnerability, your login security doesn't matter. In those cases, it helps if the s'kiddies skipped your site altogether because they couldn't be bothered to wait to find where your ssh port is.
Ah, thanks. That's a big if, but it has happened, so it makes some sense.