On Fri, 2008-04-11 at 17:57 +0300, Antti J. Huhtala wrote: > I wanted to draw attention to the > fact that default Fedora installation *does* have ssh marked as "secure > service". You can disable that while installing, though, but what is the > newbie to do? Does he know offhand that ssh is not really secure unless > special steps are taken? No, he accepts default values. > After realising (with Ethereal, later Wireshark) there were multiple > attempts to get in via ssh, I installed fail2ban, and did get lots of > addresses in fail2ban logs in a relatively short while (2-3 weeks). > I deliberately left ssh open to see how well F8 with fail2ban could cope > with (almost) default F8 installation. It took about 20 days for someone > to get in and then run various commands until he found a vulnerable one. > I caught that soon after realizing the logwatch messages no longer came > either to my alias or root. And how was the break-in achieved? They lucked out and discovered your password? They managed to break in without a password? The first way should be avoidable with really good passwords. The chances of a lucky guess that your password is "cattle" are fairly slim, but within the realms of pot luck. The chances of them guessing that your password is "twoelephants&adonkey" have to be astronomical. Pick something even longer, and I think that they're never going to crack the password. If they can't break in without cracking a password, and the attempts aren't too much of a CPU load, and don't fill up your log file with junk, then I wouldn't worry too much about SSH. If you're concerned about log files having so much dross, then some simple firewall filtering would be enough. If there really is a way to force their way in without a password, then other methods are needed (not that I've heard of it being possible). But there's probably far more chance of someone hacking a system when a less than clueful webmaster runs a webserver with really bad scripts. -- (This computer runs FC7, my others run FC4, FC5 & FC6, in case that's important to the thread.) Don't send private replies to my address, the mailbox is ignored. I read messages from the public lists.
