SSH Security

[Bazu135]

Right - will do. Thank you!

[William Haller]

fwbuilder is also a GUI manager for iptables that is worth a look. It is used for building and distributing the rule sets - not for real time monitoring of what is going on. It will build rule sets for several other firewall systems and devices as well. It may seem like overkill at first, but it does make the development and deployment of common rule blocks across multiple systems much easier.

[stevea]

If you disable passwords sshd_config ...
PasswordAuthentication no
ChallengeResponseAuthentication no
*BOTH* then you'll get no script kiddie attacks.

With either enabled you get a chance to try a password .......

[stevea@crucibulum ~]$ ssh foobar@localhost
Password:
Password:
Password:
foobar@localhost's password:
Permission denied, please try again.
foobar@localhost's password:
Received disconnect from 127.0.0.1: 2: Too many authentication failures for foobar

Without BOTH set to "no" and only "PubkeyAuthentication yes"

[stevea@crucibulum ~]$ ssh stevea@localhost
Permission denied (publickey).
[stevea@crucibulum ~]$

Even script kiddies aren't dumb enough to try to brute-force a key.
=========

Rate limiting connection isn't a bad idea to avoid DoS generally. But you wont get the attampts when you ...