Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #196537

Re: Undesired ssh login attempts

Show all headers | View raw

On Sun, 2018-06-10 at 11:09 +0000, Dan Purgert wrote:
> deloptes wrote:
> > Hi,
> > I recently get many of those, which means someone found out that
> > ssh
> > external is on port 22222 and is trying to do some evil work there.
> > Should I worry or do something?
> 
> Use key-based auth only
> Ensure root ssh login is not allowed
> Perhaps fail2ban (or equivalent)
> Perhaps forget about funny ports (as they're "security by obscurity"
> at
> best).

I've generally used the following on machines that allow ssh login:

AllowUsers root@<ip of local host> ...
# may be impractical for systems that have many logins, but mine don't)
PermitRootLogin prohibit-password (OpenSSH default)
PasswordAuthentication no
ChallengeResponseAuthentication no (Debian default)

The private key for root access on a machine is owned by a dedicated
administration account on the system, is unique to the machine, and is
passphrase protected. On some machines the admin account is only
accessible to access from the machine. On most systems the root
password is a random string that was discarded after being set.

SSH runs on port 22, since the attempt volume has not been high
recently. The firewall denies port 22 access.

These seemed to me a reasonable compromise between security and
convenience. 

Tom Dial
tdial@acm.org

> 


> 

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Undesired ssh login attempts deloptes <deloptes@gmail.com> - 2018-06-10 13:00 +0200
  Re: Undesired ssh login attempts Dan Purgert <dan@djph.net> - 2018-06-10 13:20 +0200
    Re: Undesired ssh login attempts Roberto C. Sánchez <roberto@debian.org> - 2018-06-10 14:30 +0200
      Re: Undesired ssh login attempts Dan Purgert <dan@djph.net> - 2018-06-11 12:10 +0200
    Re: Undesired ssh login attempts Thomas D Dial <tdial@acm.org> - 2018-06-11 03:50 +0200
  Re: Undesired ssh login attempts Reco <recoverym4n@gmail.com> - 2018-06-10 13:30 +0200
    Re: Undesired ssh login attempts Dejan Jocic <jodejka@gmail.com> - 2018-06-10 14:30 +0200
    Re: Undesired ssh login attempts deloptes <deloptes@gmail.com> - 2018-06-10 16:40 +0200
    Re: [Debian] Re: Undesired ssh login attempts Jim Popovitch <jim@k4vqc.com> - 2018-06-11 13:20 +0200
      Re: [Debian] Re: Undesired ssh login attempts Reco <recoverym4n@gmail.com> - 2018-06-11 14:00 +0200
        Re: [Debian] Re: [Debian] Re: Undesired ssh login attempts Jim Popovitch <jim@k4vqc.com> - 2018-06-11 14:10 +0200
          Re: [Debian] Re: [Debian] Re: Undesired ssh login attempts Reco <recoverym4n@gmail.com> - 2018-06-11 14:30 +0200
            Re: [Debian] Re: [Debian] Re: [Debian] Re: Undesired ssh login  attempts Jim Popovitch <jim@k4vqc.com> - 2018-06-11 15:00 +0200
  Re: Undesired ssh login attempts likcoras <likcoras@riseup.net> - 2018-06-10 13:30 +0200
    Re: Undesired ssh login attempts Joe <joe@jretrading.com> - 2018-06-10 14:30 +0200

csiph-web