SSH multiple ports?

Question

I'm looking for a way to increase ssh security in my home data server, since it is connected to the internet. Right now I only have two users allowed to SHH into the server, one sudoer for administrative purposes and one chrooted for SFTP use, and both are using ssh RSA keys (password login is disabled).
Is there a way to :
1) Each user only be accessible through a specific port?
2) Disable SFTP protocol for the admin user?
I've though that it might be possible by running multiple sshd instances, but I doubt that is even possible.

Answer 1

joaocandre wrote:1) Each user only be accessible through a specific port?
This is called "security by obscurity" and doesn't really help anything. It only introduces more vectors for configuration management errors.
2) Disable SFTP protocol for the admin user?
Same as above, as long as you have root access reachable, it doesn't make sense to disable it in other instances, the attack vector is the same and if the attacker can break one, he can also break the other.
I've though that it might be possible by running multiple sshd instances, but I doubt that is even possible.
This is easily possible and quite common. The use case, however, usually isn't security but something practical - like having sshd listen on other well-known ports to fool some firewalls or proxies or having a backup sshd available when experimenting with the primary one. You can run an ssh daemon as user as well. This would add someting to the security if configured properly.
Last edited by mr.MikyMaus (2015-03-18 16:47:21)