Re: ssh: Permission denied

One of the dangers of allowing root is that it has to check the password, so thats a potential security risk in that its work for the machine to do, so every attempt causes cpu usage, and if you have 1000 ssh attempts a second, thats alot of work for it to do... Another more valid risk is that many passwords can be easily guessed or are plain text. Newer passwd commands warn you about this, but many still do not. So if your password is "p@ssw0rd" its very likely to be found easily.

The BEST way to allow root access is through ssh keypairs, that way no password is involved!

- Donald Tripp
dtripp@xxxxxxxxxx
----------------------------------------------
HPC Systems Administrator
High Performance Computing Center
University of Hawai'i at Hilo
200 W. Kawili Street
Hilo, Hawaii 96720
http://www.hpc.uhh.hawaii.edu


On Dec 22, 2006, at 9:34 AM, Dylan Semler wrote:

On 12/22/06, Manuel Arostegui Ramirez <manuel@xxxxxxxxxxxxxx> wrote:
El Viernes, 22 de Diciembre de 2006 19:22, Tim escribió:
> Tim:
> >> What happens if you try to log in as a non-root user?
>
> Simon Wu:
> > Not root works fine.
>
> You've got two choices:
>
> 1. Change the configuration to allow remote root login. You can do this
> by editing "/etc/ssh/sshd_config" (it's quite easy to spot what needs
> changing).

Definetly, that's not a good idea at all.

Here's something that I've always been curious about. I assume that the dangers of allowing root log-in are:

1. It's a user name that every linux system (except ubuntu) has, so all a hacker needs is the correct password in order to gain access, rather than the correct user name and password.

2. Once access is gained, there are no restrictions on what the user can do, as they are root.

However, if you use an 8-digit password with capital and lowercase letters, numbers, and symbols, there are 8^( 26*2 + 10*2 + 20 ) = 8^92 = 1.21e83 possible passwords. Since ssh waits about a second after each incorrect password and there have been only 3.32e17 seconds in the history of the universe, it seems scritcly / impossible/ for a password to be guessed. So the risk must not be from password-bots. What is the risk then?

Also, right now I set up sudo so it doesn't prompt for passwords, so in effect, any user that logs in can become root. Is this very very bad as well?

--
Dylan

Type faster. Use Dvorak:
http://dvzine.org
--
fedora-list mailing list
fedora-list@xxxxxxxxxx
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list

--
fedora-list mailing list
fedora-list@xxxxxxxxxx
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list

Relevant Pages

  • Re: which PC
    ... when User tries to perform the task that requires root authority, ... includes Risk Assessment and Risk Management, ... so that comparative assessments can be made. ... I doubt that you've ever conducted a formal Risk Assessment. ...
    (rec.photo.digital)
  • Re: Wisdom Tooth Coronectomy
    ... > sufficiently close to some nerve that there is a risk that her lip may ... the root fragments, ... > carries a risk of permanent anaesthesia but that the risk is lower ...
    (sci.med.dentistry)
  • Re: [SLE] Error on virusscanning
    ... > The risk isn't huge (unless you do everything as root all the ... That is what I enjoy with Linux. ... I never have to work as root (can, ... work properly as a normal user; it requires Administrator rights, ...
    (SuSE)
  • Re: XP SP2
    ... root -- since they did publish it to MSDN on the date they said they ... > That site confirms my claim that a valid digital signature makes the SP2 ... >> risk adverse person waits until the official download site has the ... >>>>>It will be there tomorrow on the download site. ...
    (microsoft.public.windows.server.sbs)
  • Re: ASP.NET 2.0: onmouseover
    ... It could be that you are using relative Image links ... /Images/button-login.gif (thats if the Image folder is in the root of ... if Images is in the root of the ... Hope thats helps ...
    (microsoft.public.dotnet.framework.aspnet)