Linux Format forums

RD · Posted: Mon Sep 19, 2005 1:28 pm Post subject: ssh attack

Hi

today i looked at my system logs (main auth.log) and found that there has been 6 ssh attempts on my computer Shocked

none of which have got in Very Happy

it would seem from the auth.log that they are using a dictionary mounted attack (god help them if there using John as that is use less still has not broken my password since LXF 71 was released). So im posting just to say check you auth.log see if there are any ssh connections to your box i dont know if these attacks are from a company/script kiddie or other

nelz · Posted: Mon Sep 19, 2005 4:14 pm Post subject: RE: ssh attack

It happens all the time. the safest approach is to disable password logins to SSH, limiting it to key authorisations only.
_________________
Unix is user-friendly. It's just very selective about who it's friends are.

RD · Posted: Mon Sep 19, 2005 4:58 pm Post subject: RE: ssh attack

i have

, thanks any way just thought i would let ever one know maybe they can see if there system has been attacked like mine
_________________
[url=irc://irc.ixl2.org/ixl2]irc.ixl2.org[/url]

nordle · LXF regular Joined: Fri Apr 08, 2005 10:56 pm Posts: 1497

I don't know realistically how much extra security it gives, but you can change:

1. Only allow ssh version 2 connections
2. Change the AllowUsers section to only include an internal IP range
3. Change the default port number from 22

As well as the key access, I have no idea if these are any good or not, just some notes I've got.
_________________
I think, therefore I compile

RD · Posted: Mon Sep 19, 2005 11:57 pm Post subject: RE: ssh attack

Thanks nordle but if i was that worried id simply stop the port on my router and stop sshd untill needed Smile

_________________
[url=irc://irc.ixl2.org/ixl2]irc.ixl2.org[/url]