• ShortN0te@lemmy.mlEnglish
    0·
    7 months ago

    Imagine that the xz exploit actually made it into your server, so your sshd was vulnerable. Having it on another port does seem helpful then.

    Nope. Your entire server can be scanned in less than a second for an open ssh port.

    IPv6 does not change the fact since when your server is attacked the hist IP is already known.

    • solrize@lemmy.worldEnglish
      0·
      7 months ago

      Maybe I’m missing something but how is the host ip known? The server has a maybe-known range of addresses, but I don’t announce which address has an sshd listening. There are 2**64 addresses in the range, so scanning in 1 second doesn’t sound feasible.