Re: [Full-disclosure] Brute force attack - need your advice

Tonnerre,

My apologies if I suggested you did not have it setup right or
anything bad about your abilities. That was not my intention. I've
just had good luck with it. That's the bad part of email as a medium.

You have earned my respect.

As far as Heat I was speaking more of kiln, molding into another type
of object completely, which is overkill anyway.

Again, it's great to have a good debate. Servers are here to serve as
you said and I too believe there is a line where security impacts
productivity.

Thanks again for your responses, I like it when someone keeps me on my
toes :)

Tonnerre--feel free to email me directly anytime. I would enjoy a
voice conversation with you sometime as well.

Thanks
Keith

On Feb 12, 2008, at 9:16 AM, Tonnerre Lombard wrote:

Salut, keith@xxxxxxxxxxxxxx,

On Tue, 12 Feb 2008 08:17:13 -0500 (EST), keith@xxxxxxxxxxxxxx wrote:
been using since begining of project, but requires a lot of learning
to setup properly" and as I stated nothing is foolproof or totally
secure. Other measures need deployed as well such as an application

I would not suggest that I have not set it up correctly, because it
recognized all the background noise attack patterns just well (and did
not notify), but nevertheless it was totally incapable of detecting
anything which could really have been interesting.

It takes quite a bit of heat and even then some data can be
recovered, from magnetic residue, in labs. Usually cost prohibitive
unless someone really wants your data bad and has a big budget.

But please state a config that someone with experience can not get
into, is more of a point that security is ever evolving.

Well, you can take Flash storage and put 300-400V or so at the
contacts - just enough to melt the core before the contacts. If the
voltage is too high, only the contacts melt away and the core stays
intact. That is the only really erasable medium I'm aware of.

An alternative for the longer term is a PGP smart card with an 8192
bit
RSA (not! DSA) key which you simply break apart as you get into
trouble. It takes a while to reverse engineer the data.

But as I said, this is pure populism, servers are here to serve, not
to
be made inaccessible. It is possible to maintain reasonable security
without achieving unusability.

Yup it is security by obscurity and it will help against a script
kiddie that won't take the time to scan all ports, thats why I
suggested move to a high non-standard port.

That script kiddie won't find its way into a reasonably maintained
server anyway, it takes someone clued to do it.

I'm not talking about downloading blacklists but dynamic firewall
rules and scripting to achieve a dynamic list based on ranking of
attacks against the box. Google does have a few references and

Me too; there are e.g. scripts which evaluate failed logins from
syslog
and ban them. Thus the mention of the user name with spaces, some of
these scripts fall for that trick.

Tonnerre
--
SyGroup GmbH
Tonnerre Lombard

Solutions Systematiques
Tel:+41 61 333 80 33 Güterstrasse 86
Fax:+41 61 383 14 67 4053 Basel
Web:www.sygroup.ch tonnerre.lombard@xxxxxxxxxx

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Relevant Pages

  • Re: Microsoft Strategic Technology Protection Program
    ... servers and workstations through GPOs. ... that it's impossible for users to inadvertently execute worm scripts. ... and other security patches using startup scripts written in JScript. ...
    (NT-Bugtraq)
  • Re: terminal server config
    ... Policies to these new security groups. ... > meaning that I want the users to be mapped to the site local server shares ... > the setup in mind is to place the TS servers in the site OU instead of all ...
    (microsoft.public.win2000.group_policy)
  • finding bad things and centralizing security
    ... I manage 10 servers, each hosting a large number of virtual servers using ... to centralize management of the security and the services on the servers, ... reporting intrusion attempts, and tripwire for reporting unusual filesystem ... with users who are installing scripts with the purpose of exploiting their ...
    (Security-Basics)
  • merging domains
    ... security currently they all have trusts setup between domains as well ... as secondary DNS setup on each. ... The servers are setup at different ...
    (microsoft.public.windows.server.active_directory)
  • Re: ISA and Exchange 2007
    ... "ISA is just another level of security" - I don't think I've ever heard it ... HTTP-level validation (blocks HTTP-based attacks so your Exch servers ... Jim Harrison (ISA SE) ... The reason I say this is that if you setup OWA correctly and use ...
    (microsoft.public.isa)