Re: Need urgent help regarding security

From: Marian Hettwer (MH_at_kernel32.de)
Date: 11/22/05

  • Next message: Arne : "Re: Need urgent help regarding security" 
    Date: Tue, 22 Nov 2005 20:10:29 +0100
To: Roger Marquis <marquis@roble.com>

    Hi Roger,

    Roger Marquis wrote:
    > ray@redshift.com wrote:
    >
    >> The point isn't to get more secure. You are correct by saying that
    >> moving the port # doesn't make anything more secure.
    >
    >
    > Actually the point _is_ security and changing the port number _does_
    > improve it significantly though only from one popular attack vector.
    >
    > Security by obscurity _does_ work and often very well just not in
    > place of more substantive measures. In the case of sshd dictionary
    > attacks those would be:
    >
    > 1) setting "MaxAuthTries 2", "Banner /etc/issue" and
    > "PermitRootLogin no" in /etc/ssh/sshd_config,
    >
    good ideas!

    > 2) running an sshd IDS that A) tests for '(for invalid user|Failed
    > password for)', B) blacholes source hosts 'ipfw add deny ...', and
    > C) alerts sysadmin or operations personnel,
    >
    Be careful with adding ip addresses to deny via a packet filter. If an
    attacker uses spoofed IP adresses, you may produce yourself easily a
    denial of service attack. Say I used the IP address of your default
    gateway. If you don't check that and just add a deny rule... well... bad
    luck ;-)
    However, if being careful, using a packet filter to deny access for
    these attackers sounds like a very good way.

    > 3) making sure SSL and SSH are up to date (preferably via ports),
    >
    of course :)

    > 4) deleting the rc script, adding sshd to /etc/inetd.conf, and
    > taking advantage of the rate controls, logging, and other excellent
    > security features of FreeBSD's inetd.
    >
    full ack too.

    > Hosts that don't have at least these 4 protections in place will
    > reduce their exposure by moving sshd to a port other than 22. Hosts
    > that do implement these protections will still benefit from changing
    > the port but can lose some excellent logging. If possible keep the
    > logs and either send them to the offending ISP or add to a local
    > list of long-term blackholes.
    >
    > Obscurity is an important and wholly necessary part of the security
    > toolkit. Take passwords for example. Defining a non-dictionary
    > password is security by obscurity. It is, however, weak protection
    > if you do not also log dictionary attacks and blackhole offenders
    > before they can try many username/password pairs. ATM PINs are even
    > weaker than passwords but are nevertheless adequate protection
    > thanks to the fact that ~3 failed passwords will cause the account
    > to be locked.
    >
    > Bruce Schneier looks at more areas on where security by obscurity
    > works and where it doesn't in the May 2002 CRYPTO-GRAM
    > <http://archives.neohapsis.com/archives/crypto/2002-q2/0005.html>.
    >
    I definetly take a look into that paper :)

    thanks and best regards,
    Marian

    _______________________________________________
    freebsd-security@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-security
    To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"

  • Next message: Arne : "Re: Need urgent help regarding security"

    Relevant Pages

    • RE: Concepts: Security and Obscurity
      ... The cost of initiating the attack is not increased ... way but listening on some completely off-the-wall port and non-default ... Subject: Concepts: Security and Obscurity ...
      (Security-Basics)
    • Re: ID-ing Hackers
      ... I'm using my sonicwall firewall to trace the incoming connections ... port 25 and cross referencing them to my security log and the blocking IP ... I took everyone's advice from here and boosted my passwords to 15 digits. ... That log is an attempt on port 25... ...
      (microsoft.public.windows.server.sbs)
    • Re: ID-ing Hackers
      ... I'm using my sonicwall firewall to trace the incoming connections to ... port 25 and cross referencing them to my security log and the blocking IP ... I took everyone's advice from here and boosted my passwords to 15 digits. ... That log is an attempt on port 25... ...
      (microsoft.public.windows.server.sbs)
    • Re: can they hack into my computer?
      ... attack on some suspiciously encrypted strings of text trying to ... reliable, in terms of security, can SE Linux possibly be, given ... Don't forget about "back door" passwords and multiple points ...
      (alt.internet.wireless)
    • Re: Need urgent help regarding security
      ... security features of FreeBSD's inetd. ... Hosts that don't have at least these 4 protections in place will ... reduce their exposure by moving sshd to a port other than 22. ... Take passwords for example. ...
      (FreeBSD-Security)