Re: How do I prevent unauthorized ssh login attempts?

At 11:22a -0400 on 26 Apr 2007, Hal wrote:
On Apr 26, 2007, at 8:34 AM, Kevin Hunter wrote:
In general, utilizing public/private keys for remote authentication is /much/ more secure than passwords.

There is some debate about which is more secure
public/private keys or username/password.

Yep, thank you for that reminder. :-) I suppose we now know what I'm arguing!

With public/private keys anyone who has
access to your machine has access to any machine
your machine has a key on.

Without a passphrase, I'd agree. The key word that I made sure to put in was 'remote'. With passphrases, it becomes a two-step authentication, one locally to unlock the private key, and one remotely to at least confirm that you have the other half of the key.

The other thing that I personally like about public/private key combinations is that for the more lazy of us, we don't always check the fingerprint matches. If I decide to log on to a remote machine to which I've not logged directly on before (e.g. a company NFS- shared home directory), then I can be assured that I'm not falling victim to a man-in-the-middle attack; I can blindly accept the fingerprint, and if it hangs, I can guess that I'm in the middle of an attack attempt, and try another avenue to get where I'm going.

With username/password protection is only as
strong as your password. But your password is
needed.

Yep. I agree.

So... Use a firewall which limits access to only machines
you are willing to let in.

Yep. I agree. See Bill's page about limiting number of connections per time frame as well.

Use hosts.allow to further restrict access to ssh.

Yep. I agree.

Change the ssh port to something not generally known.

This I place into the category of security-through-obscurity, which I don't find a particularly comforting method. So it adds a single extra layer, but if a cracker is worth her/his salt, it's easily discovered and, in my opinion, not worth the extra effort it takes me to type -p <PORT> everytime. (Yes, I could use an alias or some such, but that's still extra thought-power that I'd rather place elsewhere.)

In sshd_config use the AllowUsers parameter to allow
specific users to have access to ssh.

Yep. I agree.

I think that in the end, those who are security conscious, such as presumably you and me, the specifics of how we do it become largely a moot point or highly dependent on what it is that we're securing. My personal preference is to follow the 80/20 rule. I don't have 100% of my time to devote to doing the exact right thing. But I do have 20% of my time to devote to doing 80% of the exact right thing. If/ when that becomes a problem, I'll reevaluate my approach.

On that note, you may know better than I do: is there a web page or blog somewhere that coalesces all the different things that should be done/are currently best-practice to secure a system? Especially to a *BSD noob?

Thanks,

Kevin
_______________________________________________
freebsd-questions@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscribe@xxxxxxxxxxx"

Relevant Pages

  • Re: Enabling telnet, ftp, pop3 for root...
    ... authentication (hence no typing of passwords) is easier than using ... So SSH is easier and more secure. ... Do you have any idea how public/private keys ...
    (alt.os.linux)
  • Re: PEAP-TLS vs EAP-TLS
    ... The documentation is correct in the order of being most secure though most ... confusing here is that EAP and EAP-TLS are not the same. ... does not allow authentication to be done in clear text. ... Take a look at "Securing Wireless LANs with Certificate Services" ...
    (microsoft.public.windows.server.security)
  • Re: RE: Telnet/SSL v SSH
    ... My real question is which is better to secure the communication between them. ... I'm interested in authentication and non-repudiation if possible. ... >nearly the same robustness as SSH from the perspective of Authentication, ...
    (Security-Basics)
  • Re: PEAP-TLS vs EAP-TLS
    ... and PEAP is that PEAP is a two-step process where 1) the RADIUS server is ... authenticated to the client via the RADIUS server's certificate, ... encrypted TLS channel is set up for 2) client authentication (either using ... But I wonder how much more secure PEAP-TLS is than EAP-TLS, ...
    (microsoft.public.windows.server.security)
  • Re: Login Page
    ... > I am looking for a way to make my website secure. ... > authentication tied into a login page. ... Dim strADsPath ... Tom Kaminski IIS MVP ...
    (microsoft.public.dotnet.framework.aspnet)