Re: Attacker damaged my system via ssh. I' m shocked.
- From: General Schvantzkoph <schvantzkoph@xxxxxxxxx>
- Date: Sun, 04 Jun 2006 18:20:04 -0400
On Sun, 04 Jun 2006 12:41:51 -0700, aunil321 wrote:
Hi all,
i have using FC4 for home server a few months with service httpd,
mysqld, vsftp and squid. i have 2 lan interface, eth0 (for local lan)
and eth1 (for internet ip address). One day i checked my
"/var/log/messages", i found someone used ssh trying to invade my
system.
x.x.x.x = my eth1 ip
not x.x.x.x = attacker ip
On June 2' night:
Don't allow password authentication for ssh, require RSA authentication.
Put the public key of your laptop and any other systems that you want to
give access to into the authorized_keys file.
One more thing you can do is to move your ssh port from 22 to something
else. The port scanning programs only attack port 22. Obviously there is
nothing to prevent someone from writing a port scanning program that looks
for ssh on a port other than 22 but no one has bothered to do it yet. I
have two ssh servers on my network one is on port 22 and one is on a
higher port. The server on port 22 is attacked several times a day, the
other one has never been attacked. You are probably wondering why I don't
put both servers on a high port number. The reason is that large company
firewalls don't allow outgoing ssh traffic on ports other than 22. When I
had my release server on a high port it worked fine for my clients at
startups but when I got a couple of big company clients they weren't able
to access my server. When I put the port down to 22 they were able to
access it. I requires RSA authentication on both of my servers so the
attacks are never successful, but it is annoying.
.
- Follow-Ups:
- Re: Attacker damaged my system via ssh. I' m shocked.
- From: left_coast
- Re: Attacker damaged my system via ssh. I' m shocked.
- References:
- Attacker damaged my system via ssh. I' m shocked.
- From: aunil321
- Attacker damaged my system via ssh. I' m shocked.
- Prev by Date: Re: Attacker damaged my system via ssh. I' m shocked.
- Next by Date: Re: Attacker damaged my system via ssh. I' m shocked.
- Previous by thread: Re: Attacker damaged my system via ssh. I' m shocked.
- Next by thread: Re: Attacker damaged my system via ssh. I' m shocked.
- Index(es):
Relevant Pages
|
