Re: SSHBrute Force: False Postives

[franck <joncourt_franck@yahoo.co.uk>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Wakko Warner wrote:
> Michael Rash wrote:
>>> franck joncourt wrote:
>>>> In order to prevent such attacks, you can write iptables rules to set up port knocking. This is the way, I do.
>>> I thought about doing this, but I ultimately decided against it.  The
>>> problems of doing the knocking outweighted the benefits.  I prefer to let
>>> them try a few times before my current rules ban them.
>> If someone finds a remote exploit in sshd, then just allowing
>> connections at all can potentially expose you to compromise.  As far as
> 
> True.
> 
>> port knocking is concerned, I agree, there are a ton of problems.  There
>> is a better alternative called Single Packet Authorization:
>>
>> http://www.cipherdyne.org/fwknop/docs/SPA.html
>>
>> Fwknop is an implementation that is based around iptables:
>>
>> http://www.cipherdyne.org/fwknop/
> 
> This still means that all authorized users have to do this which is not what
> I want to do.  What if I'm at someone's house and decide I want in to my
> system and they don't have any way of performing the port knocking or the
> fwknop.
> 

According to me, the only way to safely use ssh without having any
sequence to perform, is the use of private/public key with passphrase.

I have already heard about encrypted knocks, and this one seems great. I
will give it a try.

- --
Franck Joncourt
http://www.debian.org
http://smhteam.info/wiki/
GPG server : pgpkeys.mit.edu
Fingerprint : C10E D1D0 EF70 0A2A CACF  9A3C C490 534E 75C0 89FE
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFFw6GAxJBTTnXAif4RAvVCAKDPqJCbdfkwUY/BBqB5wbsVLWJqlwCgq3/3
jv30ZCnHgUxBAy25ekdnmBw=
=x2og
-----END PGP SIGNATURE-----

		
___________________________________________________________ 
Inbox full of spam? Get leading spam protection and 1GB storage with All New Yahoo! Mail. http://uk.docs.yahoo.com/nowyoucan.html