News for hackers. Stuff that matters.

A comment on SSH Brute Force – The 10 Year Old Attack That Still Persists. Parent comment

Re:SSH Brute Force – The 10 Year Old Attack That Still Persists by erhardm on Monday July 15, 2013 @12:48PM (#6046746)
I still think that it's a good idea to change the default port for sshd, even if you don't let root to login and use public key auth and fail2ban. Why? Because this "obscurity" helps keeping false possitives to a reasonable low number, so you can actually see if there's a tageted attack or not.

If I see a auth failure "root"-"123456" I instantly know that's not a targeted attack, it will unnecessary fill my log files that will add with time and become a burden to audit my systems, which at some point I either don't do it thoroughly or any at all.

SELinux takes care of controling which application could open outbound ports, so if your box is properly configured, there are other ways to reduce the impact if the box is exploited

[ Parent | on HN ]
Re:SSH Brute Force – The 10 Year Old Attack That Still Persists by andrewcooke on Monday July 15, 2013 @01:29PM (#6047079)
do (can?) auth failures display passwords? if so, is that a good idea? people (ie me) sometimes enter the wrong, but valid password. having that logged somewhere seems like a bad idea.
[ Parent | on HN ]
Re:SSH Brute Force – The 10 Year Old Attack That Still Persists by DavidHogue on Monday July 15, 2013 @02:04PM (#6047369)
The standard sshd does not log failed passwords. A few years ago I was seeing a lot of brute force attempts and I was curious to see the passwords. The only way I could do it was to edit the source code of sshd to add my own logging line and recompile the whole thing.
[ Parent | on HN ]
Re:SSH Brute Force – The 10 Year Old Attack That Still Persists by erhardm on Monday July 15, 2013 @01:42PM (#6047184)
If you use public-key it only shows the ip. I don't know if you use password, 2-factor auth or Kerberos it shows any additional information.

I would guess that if you enable debugging it will show some identifiable information, I never had to debug it.

[ Parent | on HN ]