Timothy Alberts (tal...@msiscales.com)

User Information

Display Name:

Timothy Alberts

Partial Email Address:

tal...@msiscales.com

Posts:

32	total
32	in Fedora

5 Most Recent

All Posts

1) Timothy Alberts Re: [CentOS] Securing SSH

+1 vote

Oh no..they're out there. They're watching us now. They know we're talking about them. :)

CentOS

[ Profile | Reply to group ]

[ Flat Thread Threaded ]

John R Pierce wrote:
> Tim Alberts wrote:
>> iptables..add the ip of the attack source to reject?  They keep 
>> moving IP, this is very time consuming (but I am doing it).  
> ...
>
> stop thinking 'they', that implies theres someone intentionally 
> targetting you.  its just viruses randomly squirting out connection 
> requests from 1000s of infected hosts around the world.
>
>

Oh no..they're out there.  They're watching us now.  They know we're 
talking about them.  :)

_______________________________________________
CentOS mailing list
[email protected: C...@centos.org]
http://lists.centos.org/mailman/listinfo/centos

2) Timothy Alberts Re: [CentOS] Securing SSH

+1 vote

That sounds great for getting around a remote dynamic IP address, but some more...

CentOS

[ Profile | Reply to group ]

[ Flat Thread Threaded ]

David Mackintosh wrote:
> On Tue, Mar 25, 2008 at 09:48:17AM -0700, Tim Alberts wrote:
>   
>> So I setup ssh on a server so I could do some work from home and I think 
>> the second I opened it every sorry monkey from around the world has been 
>> trying every account name imaginable to get into the system.
>>
>> What's a good way to deal with this?
>>     
>
> This is what I do.
>
> http://wiki.xdroop.com/space/Linux/Limited+SSH+Access
>
>   

That sounds great for getting around a remote dynamic IP address, but 
some more authentication/security on that web page is necessary, 
otherwise, anyone who finds that web page is given access?

_______________________________________________
CentOS mailing list
[email protected: C...@centos.org]
http://lists.centos.org/mailman/listinfo/centos

3) Timothy Alberts Re: [CentOS] Securing SSH

+1 vote

Just a virus you think? They are some pretty lame account names: judy, frank, bob..However they are...

CentOS

[ Profile | Reply to group ]

[ Flat Thread Threaded ]

John R Pierce wrote:
> Tim Alberts wrote:
>> So I setup ssh on a server so I could do some work from home and I 
>> think the second I opened it every sorry monkey from around the world 
>> has been trying every account name imaginable to get into the system.
>
> actually, those 'attempts' are coming from virus infected systems 
> which randomly probe for SSH servers.    they try the same sorry 10 or 
> 15 accounts with the same lame 10 or 15 passwords, so its really just 
> an annoyance if you're anal about logwatch output.
>

Just a virus you think?  They are some pretty lame account names: judy, 
frank, bob..However they are mixed with general linux accounts:  root, 
ftp, webmaster, mysql, named, etc.  I feel less worried about that (or 
should I)?

Or are you just trying to lull me into a false sense of security?  
Muawhahahaha..

_______________________________________________
CentOS mailing list
[email protected: C...@centos.org]
http://lists.centos.org/mailman/listinfo/centos

4) Timothy Alberts Re: [CentOS] Securing SSH

+1 vote

I could do that, but if they already know about it, a simple port scan and they'll probably find it...

CentOS

[ Profile | Reply to group ]

[ Flat Thread Threaded ]

Rudi Ahlers wrote:
> Tim Alberts wrote:
>> So I setup ssh on a server so I could do some work from home and I 
>> think the second I opened it every sorry monkey from around the world 
>> has been trying every account name imaginable to get into the system.
>>
>> What's a good way to deal with this?
>>
>> _______________________________________________
>> CentOS mailing list
>> [email protected: C...@centos.org]
>> http://lists.centos.org/mailman/listinfo/centos
>>
> 1. Change the default port

I could do that, but if they already know about it, a simple port scan 
and they'll probably find it again.  Plus I gotta go tell all my client 
programs the new port and I don't know how to do that on most of them 
(what a hassle).

> 2. use only SSH protocol 2
got it.
> 3. Install some brute force protection which can automatically ban an 
> IP on say 5 / 10 failed login attempts
The only software I know that could do this isn't supported anymore 
(trisentry) or is too confusing and I don't know it yet (snort).  
Suggestions?

> 4. ONLY allow SSH access from your IP, if it's static. Or signup for a 
> DynDNS account, and then only allow SSH access from your DynDNS domain
>
Yeah my home account is on dynamic IP.  I'd love to setup the firewall 
to only allow my home computer.  You're talking about these guys?  
http://www.dyndns.com/  never used them before, but it looks like a good 
idea.  Especially since it's free (for 5 hosts) if I read correctly.

_______________________________________________
CentOS mailing list
[email protected: C...@centos.org]
http://lists.centos.org/mailman/listinfo/centos

5) Timothy Alberts Re: [CentOS] Securing SSH

+1 vote

iptables..add the ip of the attack source to reject? They keep moving IP, this is very time...

CentOS

[ Profile | Reply to group ]

[ Flat Thread Threaded ]

Mike Kercher wrote:
> iptables, disallow root login via ssh, no valid shell for users that
> don't need one, strong passwords, keys would be a good start.
>
> Mike
>
>   

iptables..add the ip of the attack source to reject?  They keep moving 
IP, this is very time consuming (but I am doing it).  I don't allow root 
login.  I think I got a good password, and I got keys setup so I know 
I'm talking to my server.
_______________________________________________
CentOS mailing list
[email protected: C...@centos.org]
http://lists.centos.org/mailman/listinfo/centos

Highlight

Profile | Posts (32)

Home > People > Timothy Alberts