Like me. When I want to connect to some machine, I must before get in a specific machine, and after I can connect in all the network.
Many things can be done: 1) No root login 2) Only a specific User (AllowUsers option on sshd_config) 3) Only a specific machine 4) Some script to analyze the logs At the "specific machine", I change some things: 1) Always use high ports, never default port 2) Hide ssh service. How ? Try SAdoor (http://packetstormsecurity.org/UNIX/penetration/rootkits/index6.html) >From packetstorm: "SADoor is a non-listening remote administration tool for Unix systems. It sets up a listener in non-promiscuous mode for a specific sequence of packets arriving to the interface before allowing command mode. The commands are sent Blowfish encoded in the TCP payload and decoded and passed on to system(3)." Its cool, and good to hide some services... Regards, Adriano. ---------- Forwarded Message ----------- From: [EMAIL PROTECTED] To: [email protected] Sent: 3 Mar 2006 09:33:56 -0000 Subject: Re: Re: RE: Internet SSH scans These SSH scans are generated ( in most of cases ) by Linux Zombie machines, infected with a kind of worm used to get vulnerable hosts to install a PBSync IRC. I just changed my default SSH port and all attacks had stoped. Another way is run somethink like DenyHosts, a python-based daemon that scans logs and put the "attacker ip" into /etc/hosts.deny: SSHD:10.0.0.1 ( for example ). CheerS ------- End of Forwarded Message ------- -- Adriano Carvalho. Desenvolvedor do projeto Honeypot-BR www.netnix.com.br
