full-disclosure - Re: Any update on SSH brute force attempts?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1098123488.7155.32.camel@www.bsrf.org.uk>
From: barrie at reboot-robot.net (Barrie Dempster)
Subject: Re: Any update on SSH brute force attempts?

On Mon, 2004-10-18 at 20:43 +0530, Raj Mathur wrote:
> Using su forces the use of passwords, which are difficult to manage in
> a multi-admin scenario.  For instance, you may have to give the root
> password to 3 different people (1 in each 8-hour shift). 

I didn't say su, I said _sudo_, theres a major difference between the
two. with sudo you can effectively define groups and fine control the
access given to these groups without requiring additional passwords.
If I had said su, that would have been bad for the reasons you pointed
out, sudo however is much better than su in a multi-admin environment
and better than solely relying on keys, the user just has to know their
non-privileged login details (pass[word|phrase|key]) and they will be
able to access selected or all root functions depending how you want to
set it up, in this scenario you can also prevent "lesser" admins from
accessing all root functions.

With this method you could use keys as the authentication method (which
is what I would use) just like you said, you'd also have the control
over the admin groups functions with minimal administration and you
would be maintaining least privilege access, all good.

-- 
Barrie Dempster (zeedo) - Fortiter et Strenue

  http://www.bsrf.org.uk

[ gpg --recv-keys --keyserver www.keyserver.net 0x96025FD0 ]
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20041018/5211825e/attachment.bin