Re: SSH scans...

From: Steve Kemp (steve_at_steve.org.uk)
Date: 12/20/04

  • Next message: KEM Hosting: "RE: SSH scans..." 
    Date: Mon, 20 Dec 2004 22:13:58 +0000
To: Raymond Lillard <rlillard@sonic.net>

    On Mon, Dec 20, 2004 at 10:45:55AM -0800, Raymond Lillard wrote:

    > This should fail for at least these reasons:
    >
    > 1. "ssh" should be configured to prohibit root logins

      Sometimes not an option. It's useful to backup machines
     with rsync, or push updates out as root. Having a different
     named account but still with UID isn't gaining much.

    > 2. All machines should be configured to prohibit
    > direct root logins except on the physical console

      That seems a bit excessive. I usually setup controls by
     IP address in /etc/hosts.allow, and /etc/hosts.deny. Then
     limit incoming SSH connections via something like:

    AllowUsers skx mp3 foo bar ...

      That way even if there is a user called 'test' with
     password 'test' (Extremely unlikely!) they cannot login.

    >
    > 3. Proper attention to passwords

      Agreed. Backup with `john the ripper` if you don't think that
     your users are following whatever password policy you have in
     place.

    Steve 

    --
# Debian System Administration
www.debian-administration.org/
  • Next message: KEM Hosting: "RE: SSH scans..."

    Relevant Pages

    • Re: preventing direct root login on telnetd
      ... > Is there a way to prevent root from logging in directly on STABLE via telnet? ... Direct root logins are enabled/disabled via /etc/ttys, ... Btw. Don't use telnet, ...
      (FreeBSD-Security)
    • Re: Re: Attacks on ssh port
      ... i stick with the standard of only one user being able to su to root, direct root logins being disabled, and deleting my toor account unless it is needed... ... >(everytime I read the previous 3 words together I shudder, ...
      (FreeBSD-Security)