News for hackers. Stuff that matters.

A comment on A Linux botnet is launching crippling DDoS attacks in excess of 150Gbps. Parent comment

Re:A Linux botnet is launching crippling DDoS attacks in exc... by smegger001 on Wednesday September 30, 2015 @12:48PM (#10305257)
One of the first things I was taught in network security was

"When installing SSH always set it to key based login only NO Password login allowed"

Passwords are not to be used here they can be broken by automated distributed attacks, strong cryptographic keys won't.

[ Parent | on HN ]
Re:A Linux botnet is launching crippling DDoS attacks in exc... by okasaki on Wednesday September 30, 2015 @12:56PM (#10305317)
A lot of things can read ssh key files, including, sometimes, internet ads: http://www.zdnet.com/article/mozilla-urges-users-to-update-f...

Passwords can't really be gotten that easily.

[ Parent | on HN ]
Re:A Linux botnet is launching crippling DDoS attacks in exc... by andrewflnr on Wednesday September 30, 2015 @01:04PM (#10305394)
Which is, among other reasons, why you encrypt your key with a passphrase.
[ Parent | on HN ]
Re:A Linux botnet is launching crippling DDoS attacks in exc... by psykovsky on Thursday October 01, 2015 @03:13AM (#10309673)
Why not just use the passphrase in the first place? Or do you think an offline attack on a key passphrase is going to be more difficult than an online attack to a server with rate limiting configured?
[ Parent | on HN ]