Re: SSH brute force China and Linux: best practices

2010-01-30 Thread Bazy
On Sat, Jan 30, 2010 at 6:47 AM, Bobby Mac bobby...@gmail.com wrote: Hola Nanog: So after many years of a hiatus from Linux,  I recently dropped XP in favour of Fedora.  Now that my happy windows blinders are off, I see alarming things.  Ugly ssh brute force, DNS server IP spoofing with scans

domain registra question

2010-01-30 Thread Deric Kwok
Hi We are doing hosting and We are interested in doing Domain registra Could you provide more info? Thank you

Re: domain registra question

2010-01-30 Thread Deric Kwok
Hi Thank you so much Do we need to setup any application for processing? I don't understand this whols. ls it serve? Thank you again On Sat, Jan 30, 2010 at 9:22 AM, hutuworm hutuw...@gmail.com wrote: You may want to check the Registrar Tasks section at http://www.icann.org/en/processes/

Re: SSH brute force China and Linux: best practices

2010-01-30 Thread Chuck Anderson
On Fri, Jan 29, 2010 at 10:47:57PM -0600, Bobby Mac wrote: What are the new set of best practices for those running a NIX home computer. Yes I have a firewall and I do peruse my logs on a regular basis. 1. Don't have services listening unless you need them. 2. If you can, move needed

Re: SSH brute force China and Linux: best practices

2010-01-30 Thread Joel Jaeggli
iptables -A INPUT -m recent --update --seconds 60 --hitcount 5 --name SSH --rsource -j DROP iptables -A INPUT -m recent --set --name SSH --rsource -j ACCEPT also enforce either strong passwords or require no passwords (e.g. keys only) and everything should be cool. Bobby Mac wrote: Hola Nanog:

Re: SSH brute force China and Linux: best practices

2010-01-30 Thread John Mason Jr
On 1/29/2010 11:47 PM, Bobby Mac wrote: Hola Nanog: So after many years of a hiatus from Linux, I recently dropped XP in favour of Fedora. Now that my happy windows blinders are off, I see alarming things. Ugly ssh brute force, DNS server IP spoofing with scans and typical script kiddie

Re: domain registra question

2010-01-30 Thread Eric Brunner-Williams
Deric, I run a small registrar, and I'm the CTO (confused, tired and overworked) of a medium sized registrar, which as it happens does offer the how to become a registrar as a consultancy product. There are a number of procedural steps to take to obtain ICANN accreditation. At that point

Re: SSH brute force China and Linux: best practices

2010-01-30 Thread James Hess
When you really want to be safe -- even one illicit access attempt may be enough to gain access.fail2ban or ssh rate limiting do not stop distributed brute force attacks. The best action depends on a tradeoff between OPSEC network operations security considerations VS any legitimate need

Re: SSH brute force China and Linux: best practices

2010-01-30 Thread Bret Clark
denyhost is one of my favorite apps. http://denyhosts.sourceforge.net/ James Hess wrote: When you really want to be safe -- even one illicit access attempt may be enough to gain access.fail2ban or ssh rate limiting do not stop distributed brute force attacks. The best action depends on a

Re: SSH brute force China and Linux: best practices

2010-01-30 Thread Peter Beckman
On Sat, 30 Jan 2010, Bazy wrote: On Sat, Jan 30, 2010 at 6:47 AM, Bobby Mac bobby...@gmail.com wrote: So after many years of a hiatus from Linux,  I recently dropped XP in favour of Fedora.  Now that my happy windows blinders are off, I see alarming things.  Ugly ssh brute force, DNS server

Re: SSH brute force China and Linux: best practices

2010-01-30 Thread Randy Bush
also enforce either strong passwords or require no passwords (e.g. keys only) and everything should be cool. what is 'password'? randy

Re: SSH brute force China and Linux: best practices

2010-01-30 Thread Joe Greco
also enforce either strong passwords or require no passwords (e.g. keys only) and everything should be cool. what is 'password'? password is that thing that you use when you don't want one compromised passphrase for your DSA key to give access to every resource under the sun that you have

Re: Countries with the most botnets

2010-01-30 Thread Sean Donelan
On Wed, 27 Jan 2010, Steven Bellovin wrote: A colleague needs to know, along with citable sources if possible. Ideally - number of zombified PCs, percentage of zombified PCs, name of nation, source. Threat reports from symantec and macafee suggest the US leads, with China a very close second.

Fwd: [Pauldotcom] Skiddy Interview

2010-01-30 Thread andrew.wallace
-- Forwarded message -- From: andrew.wallace andrew.wall...@rocketmail.com Date: Sat, Jan 30, 2010 at 9:31 PM Subject: Re: [Pauldotcom] Skiddy Interview To: Adrian Crenshaw irong...@irongeek.com Cc: PaulDotCom Security Weekly Mailing List pauldot...@mail.pauldotcom.com On Sat,

Re: domain registra question

2010-01-30 Thread John Levine
We are doing hosting and We are interested in doing Domain registra Could you provide more info? Although Eric is correct that you can become an ICANN accredited registrar, that's probably not what you want to do. Many registrars have reseller programs which allow you to sell domain

Re: domain registra question

2010-01-30 Thread Eric Brunner-Williams
On 1/30/10 8:01 PM, John Levine wrote: We are doing hosting and We are interested in doing Domain registra Could you provide more info? Although Eric is correct that you can become an ICANN accredited registrar, that's probably not what you want to do. Agree, but I'm not going to tell him