Re: [gentoo-security] new ssh worm?

[Robert Sanders]

On Tuesday 27 July 2004 12:30 pm, Greg Watson wrote:
> If you're not already doing so, I recommend to disable password
> interactive login and enforce key only logins.  This will prevent some
> of the ssh exploits, brute-force attacks, and general script kiddies.

I saw these attempts a couple days ago, and increased the security levels on 
some of our machines.

Our policy, when possible, is to implement IPTables rules.  Create a trusted 
network within a small subset of your network.  Lock down SSH from these 
IP's, any specific admin's IP's to specific destination IP's on the hosts.  
This will require being on the trusted network or a admins network and 
connecting to the magic destination IP to even see ssh.

I prefer to do this in a firewall because it's easier to find connection 
problems in the future than sshd configs, expecially the larger the network 
you have to maintain.   The first place any of your admins will check is the 
firewall.

Also, for those that have access, configure your authenticating firewalls to 
block port 22 for anywhere and require authentication to open the network.   
But, most that have these should already be doing this ;)

This is probably a little anal for kiddy attacks, but it's good measure 
if/when the next zero day ssh worm is really out.

Rob


--
gentoo-security@g.o mailing list