Linux SSH, with no open port.
Port 22 is the most scanned port on the internet. SSHepherd closes it and keeps your shell access working.
What an open linux ssh port gives away
An internet-facing SSH daemon answers every probe it receives. That answer is enough to fingerprint the OpenSSH version, match it against known CVEs, and start credential stuffing.
The usual mitigations do not remove the exposure. Moving to a non-standard port delays a scanner by seconds. Key-only authentication stops password guessing but leaves the service reachable and its version legible. Fail2ban and rate limits reduce the noise without closing the door, and every blocked attempt still lands in your logs.
The port is closed, not hidden.
SSHepherd closes the listening port on the protected host. Not filtered, not redirected, not port-knocked — there is no socket accepting inbound connections.
The host makes an outbound connection to the SSHepherd broker and holds it. An administrator authenticates to the broker, and their session is carried back down that existing outbound path. Nothing initiates a connection to the server, so there is no inbound path to exploit.
- Nothing listens inbound
- Access via broker only
- Every session monitored
What your customer notices
Administrators keep using the terminal, keys and tooling they already have.
There is no service to enumerate, so no version to fingerprint and no login to brute-force.
Failed-authentication noise from the open internet disappears, because nothing reaches the daemon.
SSH sessions can be monitored live, recorded for audit, and terminated on demand.
Watch the linux ssh demo.
SSHepherd® with Linux SSH. A recorded demo from Full Armor, the developer of SSHepherd®.
Linux SSH: common questions
Does SSHepherd replace SSH?
No. SSH is still the protocol and your existing client, keys and workflows are unchanged. SSHepherd removes the inbound listening port and carries the session over an outbound connection instead.
Is this the same as changing the SSH port or using port knocking?
No. Both of those leave a service listening — one on a different number, one behind a sequence. SSHepherd closes the port completely, so there is no socket to discover by any means.
How long does it take to protect a server?
About ten minutes per host. SSHepherd sits over existing infrastructure and does not require the network to be re-architected.
What happens to my audit trail?
It improves. Sessions run through the broker, so they can be recorded end to end and exported as a clean audit trail, rather than reconstructed from server-side logs.