With all the SSH brute force attacks that have been happening in the last week+, a number of sites have been posting some interesting ideas on various mailing lists. One of those ideas is to run SSH on something other than port 22. The big advantage here is that on many of these attacks, they would never hit the server. Seems like a win. Unfortunately.. This would not really work for something like the general login machines as too many people would need to be trained on how to get to these servers. There is claim that it has merit for systems like pamby or other "admin-only" machines. The user community is quite small and highly technical. I'm not concerned about the issue of failed logins. For machines like these, there is such a small user community this doesn't matter. I almost think having these in the mix is just slowing them down. You are not using passwords, but OTP, so... On the other hand there have been a few cases where there has been DoS attacks that could be launched, or possibly an exploit on some really old versions of ssh. Running on an odd port would keep most of the scanners searching for this kind of hole from finding the machine at all. Anyway, this is something worth considering. On one hand it's security by obscurity which never really works. On the other it's removing the bulk of the attack noise you know is just going to fail anyway. --Gene