Re: Re: SSH bruteforce on its way...
Tim Kennedy <[email protected]>
| Newsgroups | gmane.comp.security.incidents |
|---|---|
| Organization | Stainless Steel Networks |
| Message-ID | <[email protected]> |
On Thu, 20 Oct 2005, Paul Robertson wrote: > 6.) Use AllowUsers to limit which accounts can use SSH. As an addendum to 6., on most modern Linux systems[1], you can use the pam_succeed_if.so PAM module to also perform some username filtering, which can help prevent root access in the event of a vulnerability on SSH. Also, since it just returns access denied, as though you'd gotten the password wrong, it doesn't do anything to confirm if accounts are valid or invalid for attackers. in /etc/pam.d/sshd: account sufficient pam_succeed_if.so login = <username> -Tim [1] RedHat derived systems seem to all have this module, though I know that Solaris does not. -- Tim Kennedy || There are 10 types of people on Earth. http://public.xdi.org/=tck || Those who understand binary, [email protected] || and those who don't.
signature.asc
(application/pgp-signature, 189 B)
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (GNU/Linux) iD8DBQFDXSYlRLNoIPU4UzwRAnTkAJ9poCYBOQwKwZkF8vj7Kgg8EtLr6wCfdOwq YXz2EIU5Akc4EQga9/vzhFU= =QZsQ -----END PGP SIGNATURE-----