Re: Password scan

Jim Garrison <jhg@xxxxxxxxxxxxxxx> (06-12-22 11:19:05):

2) Disable root login. If you need to do remote admin, login as a
normal user and use su or sudo. Remember to give your non-root
user sudo authority BEFORE you disable root login :-)

3) Disable password-based authentication and use key-based auth only.
In key-based auth every user must possess a unique private key file
in addition to the key-file's passphrase, and no password hash is
ever sent over the wire.

Bad idea. If you need to login to a normal user first, and then issue
su/sudo to become root, an attacker can easily guess the length of the
root password, by nothing more than counting packets. When using
key-based authentication, better login to root directly.


The relevant SSHD configuration parameters are:

Protocol 2
PasswordAuthentication no
PermitRootLogin no
PubkeyAuthentication yes

And of course:

ChallengeResponseAuthentication no


Regards,
E.S.
.

Relevant Pages

  • Re: startx Fatal server error: Cannot open /dev/tty0
    ... > startx fails under your normal user login but starts normally under your ... the question become why root user ... can init the video device, ...
    (alt.os.linux.suse)
  • Re: Swap or I/O Improvement in Fedora 8?
    ... | I first login as root, and then "su" to a normal user to run the program. ... Try login as a normal user, su to root, and then from that root shell, su ...
    (comp.os.linux.development.system)
  • Re: [opensuse] login question.
    ... how can I login as su? ... I'm autologging in as normal user, and when I have to do administrative ... Additionally you can configure Sudo to allow you to become root without ... Note that the command to get a root shell from sudo is: ...
    (SuSE)
  • Re: strange and serious problem about user login
    ... > any service other than root. ... > and I try to login as normal user except root, ... > and when I start sshd in this pc, I get no errors, but when I check ...
    (Fedora)
  • Re: GUI login screen.
    ... Well i think the best solution to get around this is to setup a normal user account... ... then edit the /etc/passwd file and set that person with root permissions so as soon as they login theyre automatically made root. ...
    (Debian-User)