Re: SSH scans...

[Steve Kemp <steve () steve org uk>]

On Mon, Dec 20, 2004 at 10:45:55AM -0800, Raymond Lillard wrote:

> This should fail for at least these reasons:
>
> 1.  "ssh" should be configured to prohibit root logins

  Sometimes not an option.  It's useful to backup machines
 with rsync, or push updates out as root.  Having a different
 named account but still with UID isn't gaining much.

> 2.  All machines should be configured to prohibit
>     direct root logins except on the physical console

  That seems a bit excessive.  I usually setup controls by
 IP address in /etc/hosts.allow, and /etc/hosts.deny.  Then
 limit incoming SSH connections via something like:

AllowUsers skx mp3 foo bar ...

  That way even if there is a user called 'test' with 
 password 'test' (Extremely unlikely!) they cannot login.

> 3.  Proper attention to passwords

  Agreed.  Backup with `john the ripper` if you don't think that
 your users are following whatever password policy you have in
 place.

Steve
--
# Debian System Administration
www.debian-administration.org/