Ask HN: Anonymous person sent proof of SSH access to our production server

Re:Ask HN: Anonymous person sent proof of SSH access to our ... by netik on Wednesday July 27, 2016 @02:26PM (#12175334)

A user can always start their own SSH server. Just because you've decided to move it to a different port doesn't really encourage them. I suppose you could make this a bit more difficult for them by removing compilers (no really, you don't need compilers everywhere) and making sshd owned by root, mode 700...

However, proper ingress filtering or local iptables/pf rules would stop any unwanted inbound traffic from reaching your server, and you should definitely be using ingress and egress filtering on your network.

[ Parent | on HN ]

Re:Ask HN: Anonymous person sent proof of SSH access to our ... by TheDong on Wednesday July 27, 2016 @11:54PM (#12178219)

removing firewalls has effectively no benefit; a non-root user can trivially download and run an arbitrary distro or package manager (e.g. nix from nixos, portage from a gentoo prefix, etc) and effectively do a chroot + package management without root.

[ Parent | on HN ]

Re:Ask HN: Anonymous person sent proof of SSH access to our ... by JasuM on Thursday July 28, 2016 @01:44AM (#12178564)

The point was that you could more easily replace the SSH server with a malicious one and e.g. hijack your agent when you connect to it.

[ Parent | on HN ]