1 |
On Jan 16, 2012 3:56 AM, "Alan McKinnon" <alan.mckinnon@×××××.com> wrote: |
2 |
> |
3 |
> On Sun, 15 Jan 2012 12:54:51 -0500 |
4 |
> "Walter Dnes" <waltdnes@××××××××.org> wrote: |
5 |
> |
6 |
> > On Thu, Jan 12, 2012 at 06:30:03AM -0500, Tanstaafl wrote |
7 |
> > |
8 |
> > > This is nothing like changing the port for SSH - a port scanner can |
9 |
> > > figure that one out in seconds... |
10 |
> > |
11 |
> > A real BOFH would set up a dummy instance of sshd on the regular |
12 |
> > port, as well as a real sshd instance on another port. The dummy |
13 |
> > instance could be set up to always fail the login attempt, and with |
14 |
> > special iptable rules to not clutter up your logfile. |
15 |
> > |
16 |
> |
17 |
> Actually a real sysadmin[1] would run ssh standardly plus OSSEC with |
18 |
> active rules and dynamically block our Chinese friends |
19 |
> |
20 |
> [1] "real sysadmin" being defined as the quintessentially lazy dude who |
21 |
> is really not into causing himself pain or doing anything that would |
22 |
> increase support tickets in his inbox |
23 |
> |
24 |
|
25 |
That depends on who are authorized to access the boxen via SSH. In my case, |
26 |
only the IT Division is authorized to access them via SSH, so the "real |
27 |
sysadmin" in me (g) decides it is much easier to shift the port rather than |
28 |
implementing esoteric hardening stuffs ;-) |
29 |
|
30 |
Plus, I get the benefit of ridiculing any IT guy/gal who managed to get |
31 |
him-/herself locked out (thanks to the auto-blacklist) B-) |
32 |
|
33 |
Rgds, |