I currently have a Solaris server that hosts several web pages. I don't leave the SSH port open except for when I need to remotely need to get into the server, then when I am done I close the port on the firewall. I have noticed that even with the port being open for 40 minutes or less that in that time there are people that are trying to get SSH access to the machine with a bad user name and password.

I was wondering what the opinion is of the users of this forum regarding leaving the SSH port open all of the time, and what are your personal experiences with people trying to get SSH access to one of your boxes.

I am just looking for everyone's personal opinion and experiences regarding this issue.

I leave SSH open for hours, or days at a time, depending on where I am with anticipated travel etc.

I haven't noticed major issues when doing this, but I definitely change it to a non-default port on all my boxes.

I leave my SSH port open all the time, and yes, people try to gain access on a daily basis, but I've done three things to prevent access. First, I eliminated the ability to use a username and password to access via SSH. All access is by keys only. Second, I limited the users who have SSH access using the AllowUsers directive in sshd_config. Finally, I use a script called sshblack that monitors my logs and when it sees one of these scripts, it adds the IP to my firewall to be dropped. This last one really doesn't add to security, it mostly serves to keep my log files from filing up with these. And to be honest, moving to key-based authentication is probably the biggest help in keeping the bozos out.

<edit>
Just my 2 cents on moving the SSH port. Yes, it does cut down on the scripts pounding on the door, but don't confuse this with actually increasing security.
</edit>

I keep my SSH port open all time, but I do move the port to a less known port. Basically I use the port for a tunnel to my proxy and allow for remote access through it.

I rarely see any attempts to login. The other thing I do is only allow RSA key access and not passwords as a means of logging in.


Good luck.

Moving to keys is an excellent idea. I really need to get around to implementing that.

Good points!

Thanks for the replies. If there is anyone else that has different ideas I would like to hear them.