Hi Jeremie,
Jeremie Le Hen wrote:
Hi, Marian,
Security is not absolute, as you surely know considering the fact you
seem to be quite sensitive to it. I guess that most of running sshd(8)
are bound to port tcp/22. If a group of hackers find a hole in
OpenSSH's sshd(8) implementation in a very early stage of the
connection (IOW before authentication) but do not disclose it - and
only God knows how many undisclosed holes there are - then one can
figure they want to avail themselves of this hole by working in
collaboration with spammers or whatever. The best way they can work
for this purpose is creating a massive exploitation tool in order to
install as much spam agents as they can, before the hole is disclosed.
Not having your sshd(8) bound to port 22 would save you from being
exploited in this case.
you're right with that assumption. And yes, given the above scenario,
letting the sshd run on a different port would help. However, your
scenario counts to any daemon listening on any port. What would you like
to do? Moving httpd, smtpd and whoever to another port? :)
I'd rather say, use any tools available within FreeBSD to make your box
as secure as you need it to be. I'm thinking of fine things like
kern.securelevel for instance :)
Of course, if this particular group of hackers wants to defeat _your_
network, this measure won't prevent them from exploiting your sshd(8).
right.
There is no need to involve kiddies, given that the tools they are
using would surely appear far after the correction of the hole in the
next OpenSSH release and all serious network administrators would have
upgraded their boxes.
Being confident that the OpenSSH guys are good developers too, I'm not
that much afraid of the hackers you mentioned above (and of course no
script-kiddies either) :-)
Please, don't turn this thread into a troll.
It's definetly not my intenion to troll. If somebody thinks that I do,
I'm sorry in advance. I just have the strong feeling that moving a
daemon to another port (where it doesn't belong) won't gain any security.
best regards,
Marian
_______________________________________________
[email protected] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
