Re: Password scan

On 2006-12-23, Ertugrul Soeylemez <never@xxxxxxxxxxxxxx> wrote:

Jim Garrison <jhg@xxxxxxxxxxxxxxx> (06-12-22 11:19:05):

2) Disable root login. If you need to do remote admin, login as a
normal user and use su or sudo. Remember to give your non-root
user sudo authority BEFORE you disable root login :-)

3) Disable password-based authentication and use key-based auth only.
In key-based auth every user must possess a unique private key file
in addition to the key-file's passphrase, and no password hash is
ever sent over the wire.

Bad idea. If you need to login to a normal user first, and then issue
su/sudo to become root, an attacker can easily guess the length of the
root password, by nothing more than counting packets. When using
key-based authentication, better login to root directly.

How so? They still have to guess the password (actually two -- one for
the user account from which to invoke su/sudo and another for su/sudo
itself), and while they're doing that they're generating a log entry for
every failed attempt. Any sysadmin with a functioning brain cell is
going to perk up at that.

--

John (john@xxxxxxxxxxx)
.

Relevant Pages

  • Re: Password scan
    ... user sudo authority BEFORE you disable root login :-) ... If you need to login to a normal user first, ... su/sudo to become root, an attacker can easily guess the length of the ...
    (comp.os.linux.security)
  • Re: Is my system secure? What else should I do?
    ... As with any security, it must be a balance between secure and useability. ... remain on the root partition to be used on boot up and you don't want to ... > Security applet in the Mandrake Control Center and disable root login ... LiveCD and gain FULL access to your system that way. ...
    (comp.os.linux.security)
  • Re: Is my system secure? What else should I do?
    ... separate filesystem - with the /noexec/ and /nodev/ options. ... Disable root login over /ssh./ Better yet, ... Tighten your permissions. ...
    (comp.os.linux.security)
  • Re: help needed after intrusion from a ssh dictionary attack
    ... He used a simple ssh dictionary attack but unfortunately our ... >> root is enabled through ssh and the root password was not strong ... >> Now we are going to reset the root password but for some other reasons ... >> we don't want to disable root login through ssh. ...
    (comp.os.linux.security)
  • Re: Single User Mode and Root
    ... > so that single user mode doesn't have root privledges. ... If you want to disable root login just put /bin/false for the root shell in ...
    (comp.os.linux.misc)