Introduction When you deploy an ec2 instance or any server instance, it defaults to SSH in port 22. You already know it, so do the whole world and all of the hackers. So, most of the automated attacks start by scanning the known ports,…

Sichere Programmierung dev.to 28.08.2025, 05:50 Uhr 3 Min. Lesezeit Cloud & IT-Enterprise

↗ Quelle (dev.to)

Reagiere als Erste:r — dein Feedback zählt!

Introduction

When you deploy an ec2 instance or any server instance, it defaults to SSH in port 22. You already know it, so do the whole world and all of the hackers. So, most of the automated attacks start by scanning the known ports, say 22 for SSH.

One of the many ways to mitigate that is to change the port to a different port. Yes it won't make it bulletproof, but it will surely reduce the chances of brute force attacks.

Let's start.

This method is applicable for all kinds of servers, including your Virtual Machines, but since I have an aws cloud account, I will use that, you can just use GCP Compute instance, Azure VM as well.

what is Security by Obscurity

In simple words, it means hiding something from the attackers, believing if the attackers can't see they can't exploit.

Kind of removing your door to an unexpected location so that thieves don't find a way to enter from known places... say you removed the front door completely.

Deploy an ec2 instance

We will deploy an ec2 instance like how we usually do. In the security group, open port 22 for ssh and add a key (or generate one, save it), my key name is test-min-keys.pem.

Change the port

1. Connect to the server/instance

Ok for that we need to access the VM first, let's ssh into it normally -

Change key file permission and ssh -

chmod 400 "test-min-keys.pem"



# your key, sever IP or hostname will be different, use that

ssh -i "test-min-keys.pem" [email protected]

2. Update SSH configuration

Open the ssh config file -

sudo nano /etc/ssh/sshd_config

And look for this portion -

We will change it from 22 to 2222 - that's our door change -

Now we can just restart the ssh service and use the new port to ssh.

sudo systemctl restart sshd

But.. if you are using Selinux enabled systems like RHEL/CentOS/Amazon Linux machines then you have to run this command to tell Selinux about the change as well.

sudo semanage port -a -t ssh_port_t -p tcp 2222

If you see this error then use a different port (headache? remove the head) -

Now restart ssh service -

sudo systemctl restart sshd

Now, update your firewall, or in aws, the security group inbound rule and open port 2222 instead of 22.

3. Access the server with new ssh port

Hold your horses, just in case, test the new port before closing the old session, open another terminal tab and try to ssh with the port tag -p <port> -

# ssh -p 2222 ec2-user@<your-public-ip>



ssh -p 2222 -i "test-min-keys.pem" [email protected]

And voila! We are in!

Let's close all the sessions and try again -

Conclusion

In practice, you should never put instances in public subnet when you don't need to. Also harden the security by not allowing password based SSH access.

For ec2 instances, there's numerous ways to get access to private ec2 instances which is more secure.

Happy Coding!

CTI Threat Relationship Graph2 Knoten / 1 Relationen

CVE / Incident Software MITRE ATT&CK CWE Weakness IoC

IR-PLAYBOOK-RCEHIGH

Schritte anzeigen

SOC Incident Playbook: Remote Code Execution (RCE) Defense

WAF MitigationSofort

Virtuelles Patchen am Reverse Proxy / WAF für gefährdete URL-Pfade und Payloads aktivieren.

SecRule REQUEST_URI "@rx ..." "id:1001,phase:1,deny,status:403"

Web Shell ScanSofort

Web-Root auf neu angelegte Scripts, anomal modifizierte Dateien und Persistence scannen.

find /var/www -type f -name "*.php" -mmin -120

Outbound FilteringSofort

Ausgehenden Datenverkehr (Reverse Shells zu unbekannten IPs/Ports) blockieren.

ss -tunp | grep -E ":(4444|1337|8080|9001)"

Vendor Patching

Hersteller-Update in Staging validieren und schnellstmöglich in Produktion ausrollen.

apt update && apt --only-upgrade install <pkg>

1-Click Detection Engineering: Multi-Dialect SIEM Rules5 Formate

Regeln anzeigen

Syntax validiert (0 Fehler)

title: Detect Exploitation - Securing AWS EC2: Change SSH Port 22 to a Custom Port
id: 31a6c8f8-b5e0-4fb0-95dd-3f1bcaff597d
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-25
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access

Syntax validiert (0 Fehler)

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-25"
        description = "YARA Signature for "
    strings:
        $str = "Securing AWS EC2: Change SSH P" ascii wide
    condition:
        any of them
}

Syntax validiert (0 Fehler)

index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("Securing AWS EC2 Change SSH Port 22 to a")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

Syntax validiert (0 Fehler)

message: "*Securing AWS EC2 Change SSH Port 22 to a*"

Syntax validiert (0 Fehler)

CommonSecurityLog
| where Message has "Securing AWS EC2 Change SSH Port 22 to a"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

🎯

MITRE ATT&CK Matrix Navigator 14 Taktiken

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

💡 Tipp: Klicken Sie auf eine TTP, um Gegenmaßnahmen und SIEM-Erkennungsregeln anzuzeigen.Enterprise Matrix v14.1

🚀 Auf tsecurity.de entdecken

◀ VORHERIGER BEITRAG 4 Min

Task:Implement LLM integration and RAG system

Sichere Programmierung

NÄCHSTER BEITRAG 1 Min

Chrome Will Soon Let You Convert Tab Groups Into Bookmark Folders

Windows Tipps & SecurityWeiterlesen ▶

Blättern: Pfeiltasten [ ← ] [ → ] · Tasten j / k · mobil: Wischen

Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich Securing AWS EC2: Change SSH Port 22 to .... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen

1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.

🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC

Schnell-Prompts für Analysten

⚠️ DEFANGED SANDBOX VIEW (tsecurity.de): Alle Netzwerkindikatoren und URLs wurden neutralisiert (2 Indikatoren entschärft). Nur zur defensiven Analyse!

Format: python

#!/usr/bin/env python3
# Exploit Title: PoC for Target
import socket, sys
target = '192[.]168[.]1[.]10'
url = 'hxxp://target[.]local/vuln'
s = socket.socket()
s.connect((target, 80))
s.send(b'GET / HTTP/1.1\r\nHost: target.local\r\n\r\n')