| 1 |
On 8/26/05, Frank Schafer <frank.schafer@×××××××××.cz> wrote: |
| 2 |
|
| 3 |
> Hmmm, I think the example password should be strong enough but You are |
| 4 |
> right. Sooner or later it will come in (if sooner is something amongst |
| 5 |
> some hundreds of years and later something amongst some thousands ;) |
| 6 |
> BTW: There isn't only the password. There are log analyzers too. |
| 7 |
> Let such an analyzer catch auth failure - say 20 times within less than |
| 8 |
> half an hour - for root remote, then it can block access from this IP, |
| 9 |
> if it catches local auth failure for root - 20 times within less than |
| 10 |
> half an hour - it can logaut the user (kill his login shell) and block |
| 11 |
> the account. Mine does so. Well, in this case the sooner is something |
| 12 |
> amongst some millions of years and the later something amongst some |
| 13 |
> trillions. |
| 14 |
> ... but this already goes into the direction of IDS. |
| 15 |
|
| 16 |
|
| 17 |
You're lacking optimism... Of course the brute-force attack was not supposed |
| 18 |
to be done remotely! You can pull passwd to your local machine and the let |
| 19 |
your computer handle it without interruptions. If some proprieties of the |
| 20 |
password are known beforehand, then sooner would be a matter of hours and |
| 21 |
later a couple of days. This is not even putting into the game some |
| 22 |
distributed computing... |
Archives