Maybe I’m missing something but how is the host ip known? The server has a maybe-known range of addresses, but I don’t announce which address has an sshd listening. There are 2**64 addresses in the range, so scanning in 1 second doesn’t sound feasible.
I’ve never seen an attack that scans all ports. Normally it just checks open ports and then tries common credentials and exploits. If that fails it moves on to the next IP.
Changing the default port on SSH probably isn’t going to do much as SSH is already pretty secure. However it is a good rule of thumb to change the defaults.
Nope. Your entire server can be scanned in less than a second for an open ssh port.
IPv6 does not change the fact since when your server is attacked the hist IP is already known.
Maybe I’m missing something but how is the host ip known? The server has a maybe-known range of addresses, but I don’t announce which address has an sshd listening. There are 2**64 addresses in the range, so scanning in 1 second doesn’t sound feasible.
I’ve never seen an attack that scans all ports. Normally it just checks open ports and then tries common credentials and exploits. If that fails it moves on to the next IP.
Changing the default port on SSH probably isn’t going to do much as SSH is already pretty secure. However it is a good rule of thumb to change the defaults.