Re: some attack to fedora machine .

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



pe, 2008-04-11 kello 09:22 -0500, Mikkel L. Ellertson kirjoitti:
> Antti J. Huhtala wrote:
> > A spot of overkill, perhaps?
> > 
> > In my modest experience my Linux box has been compromised thŕee (3)
> > times that I know of. The first was an RH 6.2 box, and my present box
> > has been invaded twice, first during the FC6 era and then soon after my
> > F8 installation last December.
> > Each and every time the invader came in through ssh. Against my better
> > judgement in installing F8 I allowed ssh to remain a "secure service" as
> > suggested by the F8 installer. Well, it proved not to be.
> > 
> > There seem to be some "sportsmen" out there who just can't resist the
> > temptation of an open ssh port. Now, if I plan to use ssh to connect to
> > my box from a remote location, I'm going to have iptables rules to allow
> > ssh only from known addresses. Not very flexible, perhaps, but I don't
> > want to allow these sportsmen in again.
> > 
> > In each case, just wiping the installation clean and reinstalling with
> > ssh port closed seems to have done the trick.
> > 
> > My 2 c.
> > 
> > Antti
> > 
> You should also set up SSH to only use key pairs to allow logins. 
> Not username/passwork logins. This will foil "dictionary" attacks. 
> If you do need to allow username/passwork logins, use one of the 
> rate limiting packages to block the attacker after 3 or for login 
> failed logins in a row, or more then x attempts from one IP address 
> in a short period of time. Picking good passwords helps as well.
> 
> Mikkel
No doubt you're right, Mikkel, but I wanted to draw attention to the
fact that default Fedora installation *does* have ssh marked as "secure
service". You can disable that while installing, though, but what is the
newbie to do? Does he know offhand that ssh is not really secure unless
special steps are taken? No, he accepts default values.
After realising (with Ethereal, later Wireshark) there were multiple
attempts to get in via ssh, I installed fail2ban, and did get lots of
addresses in fail2ban logs in a relatively short while (2-3 weeks). 
I deliberately left ssh open to see how well F8 with fail2ban could cope
with (almost) default F8 installation. It took about 20 days for someone
to get in and then run various commands until he found a vulnerable one.
I caught that soon after realizing the logwatch messages no longer came
either to my alias or root.

Your tip about not allowing username/password combinations is a good
one. Any examples of an implementation of eg. key pairs?

Antti



[Index of Archives]     [Current Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Yosemite News]     [Yosemite Photos]     [KDE Users]     [Fedora Tools]     [Fedora Docs]

  Powered by Linux