full-disclosure - Re: Re: Any update on SSH brute force attempts?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20041018130141.GH1373@nemesis.ox.icnet.uk>
From: Dave.Ewart at cancer.org.uk (Dave Ewart)
Subject: Re: Re: Any update on SSH brute force attempts?

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Monday, 18.10.2004 at 06:41 -0500, Ron DuFresne wrote:

> > > What are you doing/changing about your SSH configurations to
> > > reduce the possibility of these attacks finding any kind of hole
> > > in the OpenSSH software (that's what I run, so that's the only
> > > version I'm particularly concerned about) ?  Are you doing
> > > anything at all?
> >
> > Attacks on my system seemed to be restricted to root, so I set the
> > 'PermitRootLogin without-password' option, so that no root logins
> > using a password were possible - must be RSA key.  I also switched
> > to non-standard port.
> 
> Why not just disallow root logins directly, and force someone with a
> valid user account to su after getting a shell?  It was my impression
> that was more standard, and if one has to allow remote root directly,
> at least restrict it to specific systems and users.  All the places I
> have worked for forced the su after shell to root..

Well yes, that's fair enough - however, allowing direct root access does
make certain things more straightforward, automated use of 'scp' etc.

Dave.
- -- 
Dave Ewart
Dave.Ewart@...cer.org.uk
Computing Manager, Epidemiology Unit, Oxford
Cancer Research UK
PGP: CC70 1883 BD92 E665 B840 118B 6E94 2CFD 694D E370

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFBc761bpQs/WlN43ARAv4hAKCPjpX99vCblwNdawitjNZdPTsF2ACgvA2P
ZV9EhkPzUbQ1gdIrVcxdEwo=
=UQg8
-----END PGP SIGNATURE-----