Re: bruteforce ssh

From: Wolfgang Meiners (WolfgangMeiners01_at_web.de)
Date: 10/27/05 

Date: Thu, 27 Oct 2005 18:26:59 +0200

Hello,
if have encountered the problem of bruteforce ssh attacks in my logfiles
too. I had the following idea to solve this

David wrote:

> On my ssh server I use non-standard user names, deny root login, and use
> strong passwords, which will keep the automated-dictionary-list script
> kiddes out.

strong passwords is a point, that i can not guarantee. But i can permit
password authentication and only allow public key authentication. I
simply set

PathwordAuthentication no
PermitEmptyPasswords no
UsePAM no

in my /etc/ssh/sshd_config.

> If you're really paranoid look at the AllowUsers option in
> sshd_config to only allow certain users.

I found no information about this in the /etc/ssh/sshd_config, but i
think this is a further good idea.

Maybe, someone can tell me, if there is a configuration problem, i did
not see

Wolfgang

Relevant Pages

  • password vs public key authentication
    ... Why use public key authentication vs. password authentication? ... Is it more secure to disable password authentication and just allow ... For example one did a su druing the session could the ...
    (comp.security.ssh)
  • Re: sftp
    ... Public key authentication is generally better ... as password authentication allows guessing, and DoS if you have account ... Transmission is equally secure. ...
    (microsoft.public.security)
  • Re: password vs public key authentication
    ... With public key authentication the user not only has to know the ... passphrase but he also has to have access to the key. ... > Is it more secure to disable password authentication and just allow ... For example one did a su druing the session could the ...
    (comp.security.ssh)
  • Re: Most secure SSH implementation
    ... Is public key authentication the best ... as long as the pass-phrase protecting the private key (on your windows ... server to someone impersonating you. ... password authentication has the problem that if the server is subverted ...
    (comp.security.ssh)