Re:Observations from two weeks of SSH brute force attacks
by acdha on Friday January 27, 2012 @09:45AM
(#3518410)
Or use only public-key authentication. I've run many internet-exposed servers for years without problems or kludgy obscurity measures like port knocking simply by disabling all forms of password authentication. This is faster, easier and has the advantages of not requiring non-standard client software, being observable by an attacker on the same network, and avoids the sort of rote password entry which causes mistakes and discourages long, complex passwords.
[ Parent
| on HN ]
Re:Observations from two weeks of SSH brute force attacks
by Nick_C on Friday January 27, 2012 @10:46PM
(#3521251)
With public key only authentication, how does a user get their public key on to the server in the first place?
I ask because I have two servers, one I am a client at DreamHost and I can't configure their sshd daemon, the second is my own VPS where I am root.
Re:Observations from two weeks of SSH brute force attacks
by acdha on Saturday January 28, 2012 @08:08PM
(#3524029)
You only need the ability to write to a file in your home directory. In the case of a VPS you could do that before editing the sshd config (in large environments this is trivially automated as part of your install process, which is why e.g. Ubuntu EC2 images ship with public-key-only SSH by default).
In the case of a shared server you can't disable password auth, which is a powerful argument for using a unique password since that system is far more likely to be compromised.