Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: Re: Any update on SSH brute force attempts?
From: Dave Ewart <Dave.Ewart () cancer org uk>
Date: Mon, 18 Oct 2004 14:01:41 +0100

Hash: SHA1

On Monday, 18.10.2004 at 06:41 -0500, Ron DuFresne wrote:

What are you doing/changing about your SSH configurations to
reduce the possibility of these attacks finding any kind of hole
in the OpenSSH software (that's what I run, so that's the only
version I'm particularly concerned about) ?  Are you doing
anything at all?

Attacks on my system seemed to be restricted to root, so I set the
'PermitRootLogin without-password' option, so that no root logins
using a password were possible - must be RSA key.  I also switched
to non-standard port.

Why not just disallow root logins directly, and force someone with a
valid user account to su after getting a shell?  It was my impression
that was more standard, and if one has to allow remote root directly,
at least restrict it to specific systems and users.  All the places I
have worked for forced the su after shell to root..

Well yes, that's fair enough - however, allowing direct root access does
make certain things more straightforward, automated use of 'scp' etc.

- -- 
Dave Ewart
Dave.Ewart () cancer org uk
Computing Manager, Epidemiology Unit, Oxford
Cancer Research UK
PGP: CC70 1883 BD92 E665 B840 118B 6E94 2CFD 694D E370

Version: GnuPG v1.2.4 (GNU/Linux)


Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]