RE: sshd bruteforce from 66.246.72.184

Root should not be allowed to login directly.
I could easily make the same argument for admin.
Most SSHD will allow you to limit the accounts that can login remotely.


[email protected] giac 

> -----Original Message-----
> From: [email protected] 
> [mailto:[email protected]] On Behalf Of Pehr Söderman
> Sent: Monday, February 21, 2005 3:19 AM
> To: Intrusions List (GCIA Practicals)
> Subject: Re: [Intrusions] sshd bruteforce from 66.246.72.184
> 
> 
> If I am reading this log correctly you have some pretty 
> obvious account names. It might be a good idea to look over 
> your servers and remove accounts such as root and admin and 
> replace them with dummy accounts. The security gain might be 
> small, but it stops password guessing and makes it somewhat 
> harder for an attacker if he penetrates one of your systems.
> 
> -- 
> /Pehr Söderman
> [email protected]
> Student of Computer Science
> Royal Institute of Technology, Stockholm, Sweden
> Erasmus student at Universität Karlsruhe, Germany
> 
> Cum catapultae proscriptae erunt tum soli proscript 
> catapultas habebunt.
> 
> 
> _______________________________________________
> Intrusions mailing list
> [email protected] 
> http://www.dshield.org/mailman/listinfo/intrus> ions
> 
_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions