Don't use 1234 as your password

Re:Don't use 1234 as your password by hobs on Sunday November 17, 2013 @06:31PM (#6751561)

Also, fail2ban is a useful thing in this instance. But if your password is 1234... what's the deal with that?

[ Parent | on HN ]

Re:Don't use 1234 as your password by gamegoblin on Sunday November 17, 2013 @07:54PM (#6751874)

One of the first commands I type into a new VPS:

    sudo apt-get install fail2ban

I remember when I got my very first VPS, and within a couple of days I was getting a really long bruteforce where the attacker tried every common name "aaron, adam, alex, etc" and around 120 common passwords for each of them (fortunately my text-based password on that VPS was 41 characters). I think they tried a few thousand usernames total. That's when I realized the internet is a scary place, and now I only use RSA keys.

[ Parent | on HN ]

Re:Don't use 1234 as your password by foobarian on Sunday November 17, 2013 @08:21PM (#6751966)

All our workstations at school had static, publicly routable IP addresses. I never got hacked, thankfully, but I still found out about the pervasive ssh bruteforcing fairly quickly. The brute-forcing bots apparently were rate limited to once per second. Since each failed attempt gets logged to disk, this resulted in a faint, periodic "grrrt" sound. It's hard to describe how incredibly annoying this was while sitting next to the machine; certainly annoying enough to figure out what was causing it :-)

[ Parent | on HN ]