Linux Format forums

RE: ssh attack

RD — Mon Sep 19, 2005 11:57 pm

Author: RD

Posted: Mon Sep 19, 2005 11:57 pm

Thanks nordle but if i was that worried id simply stop the port on my router and stop sshd untill needed

RE: ssh attack

nordle — Mon Sep 19, 2005 9:43 pm

Author: nordle

Posted: Mon Sep 19, 2005 9:43 pm

I don't know realistically how much extra security it gives, but you can change:

1. Only allow ssh version 2 connections
2. Change the AllowUsers section to only include an internal IP range
3. Change the default port number from 22

As well as the key access, I have no idea if these are any good or not, just some notes I've got.

RE: ssh attack

RD — Mon Sep 19, 2005 4:58 pm

Author: RD

Posted: Mon Sep 19, 2005 4:58 pm

i have , thanks any way just thought i would let ever one know maybe they can see if there system has been attacked like mine

RE: ssh attack

nelz — Mon Sep 19, 2005 4:14 pm

Author: nelz

Posted: Mon Sep 19, 2005 4:14 pm

It happens all the time. the safest approach is to disable password logins to SSH, limiting it to key authorisations only.

ssh attack

RD — Mon Sep 19, 2005 1:28 pm

Author: RD

Posted: Mon Sep 19, 2005 1:28 pm

Hi

today i looked at my system logs (main auth.log) and found that there has been 6 ssh attempts on my computer none of which have got in

it would seem from the auth.log that they are using a dictionary mounted attack (god help them if there using John as that is use less still has not broken my password since LXF 71 was released). So im posting just to say check you auth.log see if there are any ssh connections to your box i dont know if these attacks are from a company/script kiddie or other