DSM-G600, DNS-3xx and NSA-220 Hack Forum

Unfortunately no one can be told what fun_plug is - you have to see it for yourself.

You are not logged in.

Announcement

#1 2007-03-20 18:08:52

PerS
Member
Registered: 2007-03-16
Posts: 13
Website

Protect your SSH

Since the 14th I've had 891 known attacks at my dns-323 running Debian (the box is not announced anywhere)

run the following and you'll see how many you've had:

Code:

grep sshd /var/log/auth.log* | grep Invalid | wc -l

To protect it, you can  do this: http://dns323.kood.org/howto:securing_s … ce_attacks

Offline

 

#2 2007-03-20 18:32:22

fonz
Member / Developer
From: Berlin
Registered: 2007-02-06
Posts: 1716
Website

Re: Protect your SSH

PerS wrote:

Since the 14th I've had 891 known attacks at my dns-323 running Debian (the box is not announced anywhere)

run the following and you'll see how many you've had:

Code:

grep sshd /var/log/auth.log* | grep Invalid | wc -l

To protect it, you can  do this: http://dns323.kood.org/howto:securing_s … ce_attacks

That's not really the number of attacks, but more like the number of wrong username/password guesses.
Also, I get usually two lines matching "sshd" per guess, so half your number. No need to worry unless you're
using weak passwords. However, locking the bad guys out is always as good idea :-)

Offline

 

#3 2007-03-20 19:24:16

PerS
Member
Registered: 2007-03-16
Posts: 13
Website

Re: Protect your SSH

fonz wrote:

That's not really the number of attacks, but more like the number of wrong username/password guesses.

True, but you must also remember, DenyHosts will block after 5 attempts (some times it takes more before it triggers), so the number of attempts could have been much higher.

DenyHosts has blocked 11 IP address

Code:

grep sshd /etc/hosts.deny | wc -l

fonz wrote:

However, locking the bad guys out is always as good idea :-)

And that's my main point, if you leave it unattended, you'll get visitors that you don't want to be there (and eventually they'll get in).

Offline

 

Board footer

Powered by PunBB
© Copyright 2002–2010 PunBB