Re: Question on rate limiting on nftables

On Mon, 8 Jun 2026, at 4:57 PM, Lars Nood=C3=A9n wrote:
> On 6/8/26 18:01, Andre Rodier wrote:
>> Also, a connection attempts on a
>> different port should immediately raise attention, as it is involving
>> more than a basic SSH scan bot.
>
> Shifting ports might quiet the logs somewhat, but your SSH port will b=
e=20
> found both quickly and easily by bots.  That has been the case for a=20
> long time:
>
>   https://bsdly.blogspot.com/2013/02/theres-no-protection-in-high-port=
s.html

This blog post argues against security-by-obscurity. It has nothing what=
soever do with the substance of my initial post in this thread, in which=
 I wrote:

=C2=ABIf the problem can be characterised as "I endure too much log nois=
e from sshd and I find it annoying" then perhaps configure sshd(8) to ad=
ditionally bind to some other random port than 22 and expose only that p=
ort.=C2=BB

Nothing more, nothing less. I did not write, "I want to make it impossib=
le for any bot anywhere to discover that I am running an sshd service on=
 a given port forever more". Nor did I write, "I'm worried about being h=
acked and I think that switching to a different port will make that even=
tuality less likely".

Indeed, Mr Hansteen's post concedes precisely that:

=C2=ABThe immediate effect in almost all cases was a much quieter authen=
tication log.=C2=BB

The implied question can thus be framed as: do I think that increasing t=
he signal-to-noise ratio of my logs is worth a port change? In my case, =
the answer is an unequivocal yes.

--
Kerin Millar