what is the 22 port actually doing on my home network?
I work in IT, mostly sysadmin and network support. Started paying more attention to my home network after helping a friend recover from a basic SSH brute force on his self hosted setup. That got me checking my own setup and now I'm second guessing some defaults I never really thought about.
I'm trying to understand what is the 22 port actually doing in a normal home setup, and how exposed I am without knowing it. I know the basic answer, but I want to understand the real world privacy side better.
My setup at home is pretty standard. A consumer router from my ISP, a NAS box, a Raspberry Pi running Pi-hole and a few small things, and two laptops. Normal home internet, no static IP.
I ran an outside port scan on my public IP from a small server I rent, and port 22 came back as filtered, not open. That's what I'd expect since I never set up port forwarding for it. But then I noticed the NAS has SSH turned on by default on the local side, the Pi has SSH on too, and one of the laptops has remote login switched on (probably something I clicked years ago and forgot about).
also, even if what is the 22 port doing from the outside is basically nothing, on the inside it's running on a bunch of devices. That means anything on my home network (including a couple of smart plugs and a TV I don't fully trust) could try to connect. I have no real way to see if they ever do.
My router logs are not helpful for this either. The interface shows me some basic traffic but nothing detailed enough to see if random devices on my network are scanning around for SSH. And I have no idea if my ISP logs anything on their side.
The other thing that bugs me is moving SSH to a different port. Half the stuff I read says that hiding the port is pointless, the other half says it cuts almost all the random scan noise from your logs. Both kind of make sense and I can't tell which one actually matters for a home setup where I'm the only person using it.
how much of a real privacy concern is what is the 22 port doing on the inside of your network, compared to the outside? Is it worth turning SSH off completely on devices I don't actually remote into, or is the inside risk basically nothing if my router side is clean?