some attack to fedora machine .

Tim ignored_mailbox at yahoo.com.au
Sun Apr 13 05:48:55 UTC 2008


On Fri, 2008-04-11 at 17:57 +0300, Antti J. Huhtala wrote: 
> I wanted to draw attention to the
> fact that default Fedora installation *does* have ssh marked as "secure
> service". You can disable that while installing, though, but what is the
> newbie to do? Does he know offhand that ssh is not really secure unless
> special steps are taken? No, he accepts default values.
> After realising (with Ethereal, later Wireshark) there were multiple
> attempts to get in via ssh, I installed fail2ban, and did get lots of
> addresses in fail2ban logs in a relatively short while (2-3 weeks). 
> I deliberately left ssh open to see how well F8 with fail2ban could cope
> with (almost) default F8 installation. It took about 20 days for someone
> to get in and then run various commands until he found a vulnerable one.
> I caught that soon after realizing the logwatch messages no longer came
> either to my alias or root. 

And how was the break-in achieved?  They lucked out and discovered your
password?  They managed to break in without a password?

The first way should be avoidable with really good passwords.  The
chances of a lucky guess that your password is "cattle" are fairly slim,
but within the realms of pot luck.  The chances of them guessing that
your password is "twoelephants&adonkey" have to be astronomical.  Pick
something even longer, and I think that they're never going to crack the
password.  If they can't break in without cracking a password, and the
attempts aren't too much of a CPU load, and don't fill up your log file
with junk, then I wouldn't worry too much about SSH.

If you're concerned about log files having so much dross, then some
simple firewall filtering would be enough.  If there really is a way to
force their way in without a password, then other methods are needed
(not that I've heard of it being possible).

But there's probably far more chance of someone hacking a system when a
less than clueful webmaster runs a webserver with really bad scripts.

-- 
(This computer runs FC7, my others run FC4, FC5 & FC6, in case that's
 important to the thread.)

Don't send private replies to my address, the mailbox is ignored.
I read messages from the public lists.




More information about the users mailing list