Port 22 (SSH)
Secure Shell: encrypted remote login, command execution, tunnelling and file transfer (SCP, SFTP).
- Transport
- TCP
- Internet exposure
- Restrict
Expose only to specific networks, or behind a VPN.
Security notes
- Internet-facing SSH receives constant password-guessing traffic; use keys and disable password login.
- SSH tunnels (-L, -R, -D) can carry other traffic out of a network and bypass controls.
- Unexpected outbound SSH from servers can indicate a reverse tunnel set up by an attacker.
When it shows up in your logs
Many failed logins from one IP is brute forcing. A success after many failures, or logins at unusual hours, needs investigating.