some attack to fedora machine .
Tim
ignored_mailbox at yahoo.com.au
Sun Apr 13 05:48:55 UTC 2008
On Fri, 2008-04-11 at 17:57 +0300, Antti J. Huhtala wrote:
> I wanted to draw attention to the
> fact that default Fedora installation *does* have ssh marked as "secure
> service". You can disable that while installing, though, but what is the
> newbie to do? Does he know offhand that ssh is not really secure unless
> special steps are taken? No, he accepts default values.
> After realising (with Ethereal, later Wireshark) there were multiple
> attempts to get in via ssh, I installed fail2ban, and did get lots of
> addresses in fail2ban logs in a relatively short while (2-3 weeks).
> I deliberately left ssh open to see how well F8 with fail2ban could cope
> with (almost) default F8 installation. It took about 20 days for someone
> to get in and then run various commands until he found a vulnerable one.
> I caught that soon after realizing the logwatch messages no longer came
> either to my alias or root.
And how was the break-in achieved? They lucked out and discovered your
password? They managed to break in without a password?
The first way should be avoidable with really good passwords. The
chances of a lucky guess that your password is "cattle" are fairly slim,
but within the realms of pot luck. The chances of them guessing that
your password is "twoelephants&adonkey" have to be astronomical. Pick
something even longer, and I think that they're never going to crack the
password. If they can't break in without cracking a password, and the
attempts aren't too much of a CPU load, and don't fill up your log file
with junk, then I wouldn't worry too much about SSH.
If you're concerned about log files having so much dross, then some
simple firewall filtering would be enough. If there really is a way to
force their way in without a password, then other methods are needed
(not that I've heard of it being possible).
But there's probably far more chance of someone hacking a system when a
less than clueful webmaster runs a webserver with really bad scripts.
--
(This computer runs FC7, my others run FC4, FC5 & FC6, in case that's
important to the thread.)
Don't send private replies to my address, the mailbox is ignored.
I read messages from the public lists.
More information about the users
mailing list