Re: [gentoo-security] new ssh worm

[Mark Pflueger]

hi!

* KrispyKringle <krispykringle@g.o> [2004-07-28 11:32:17 -0400]:
> You could block it with iptables, by restricting allowed domains in your
> sshd_config, or by turning off password logins in sshd_config
> (restricting to public key). You could presumably limit allowed login
> addresses with tcpwrappers if none of the above methods of doing the
> exact same thing appeal to you ;)

> The thing is, some of these fixes may not be acceptible to all
> installations (for instance, I run a server in which users can log in
> from anywhere, which nixes restricting source addresses, and on which
> many users are clueless about public key authentication, which nixes
> that). However, in all honesty, I'm just not that concerned about this.
> If it's not even trying real usernames, what's the risk? Root login is
> disabled, and I have no guest, admin, etc accounts. Brute forcing over
> ssh isn't even a huge risk anyway, since it takes nearly half a second
> to try each password, and after three passwords the server disconnects
> (and there is a limit on max unauthenticated connections). At that rate,
> brute forcing a random 7 character password would take centuries.

> I don't know how this is really even a risk. Brute forcing is a known
> risk we all should have considered before. Seeing a (particularly
> clumsy) attempt at it in the wild just comforts me that at least some of
> the people out there trying to break into my server are complete and
> total idiots.

there was a lot of truth spoken in these sentences - and i laughed my
ass off reading the last sentence. thx for this msg :-D

so far

-- 
Mark Pfluger
.oooO0Oooo...oooO0Ooo

--
gentoo-security@g.o mailing list