News for hackers. Stuff that matters.

A comment on MongoHQ Security breach. Parent comment

Re:MongoHQ Security breach by jumby on Tuesday October 29, 2013 @05:43PM (#6637709)
Granted, but an airgap would make working with some internal support tool a bit cumbersome :)

Bastion servers if properly firewalled might be OK for a short term solution. The concern there is if you allow unfettered ssh (for example) is someone watching for the inevitable brute-forcing that will ensue?

[ Parent | on HN ]
Re:MongoHQ Security breach by iloveponies on Tuesday October 29, 2013 @06:05PM (#6637828)
Mandatory SSH keys mitigates the brute forcing risk, and turns it into a nuisance. My employer presently has this arrangement and has done so for a while. Bastions only get you in the door: different entrances for different environments, users keys are only propagated to the machines they need.
[ Parent | on HN ]
Re:MongoHQ Security breach by jumby on Tuesday October 29, 2013 @06:50PM (#6638084)
Roger that. I keep thinking of my customer support people as non-technical and for whom ssh keys, port forwarding & bastion hosts are way over their heads but your point is taken. There are other (cheaper!) ways to secure an internal network.
[ Parent | on HN ]
Re:MongoHQ Security breach by oomkiller on Tuesday October 29, 2013 @06:51PM (#6638091)
Disable login via password, install fail2ban to help with the extra overhead/traffic.
[ Parent | on HN ]
Re:MongoHQ Security breach by bolder88 on Wednesday October 30, 2013 @04:19AM (#6640159)
If you have ssh running anywhere, please disable password access. Use keys. It should come installed like that.
[ Parent | on HN ]