Re: Blocking SSH Brute-Force Attacks: What Am I Doing Wrong?

Gerard Seibert wrote:
On Monday November 13, 2006 at 04:10:58 (AM) Frank Staals wrote:


I had the same 'problem'. As said it's not realy a problem since FreeBSD will hold just fine if you don't have any rather stupid user + pass combinations. ( test test or something like that ) Allthough I thought it was annoying that my intire log was clouded with those brute force attacks so I just set sshd to listen at an other port then 22. Maybe that's a acceptable solusion for you ? You can change the ssd port in /etc/ssh/sshd_config

Security through obscurity is a bad idea. Rather, use SSH key based
authentication exclusively. Turn off all of the password stuff in
sshd_config. Laugh at the poor fools trying to break in.


The point is it isn't security through obscurity: as allready pointed out, FreeBSD & sshd can withstand those brute force attacks without much of a problem so there is no security problem, the only thing is those brute force attacks are anoying since they cloud authd.log If those attacks WERE a problem, or if there was a system which you could log in without user & pass if you would find out the correct port then, but only then, it is a bad idea ....

--
-Frank Staals


_______________________________________________
freebsd-questions@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscribe@xxxxxxxxxxx"

Relevant Pages

  • Re: I love IP Tables....
    ... You do know, that if you run ssh on your pet's birthday port, rather ... than 22, you will not see any of the crap brute force attacks, don't ... the other security measures must still be in place. ...
    (Fedora)
  • Re: I love IP Tables....
    ... You do know, that if you run ssh on your pet's birthday port, rather than ... 22, you will not see any of the crap brute force attacks, don't you? ... but then I've faced enough port scans to realize that security ... best way to avoid bruteforce attacks it's only allow public-private key ...
    (Fedora)
  • Re: I love IP Tables....
    ... You do know, that if you run ssh on your pet's birthday port, rather ... than 22, you will not see any of the crap brute force attacks, don't ... the other security measures must still be in place. ...
    (Fedora)