May 19, 2008 – 4:38 pm
Something that has been in the tech news recently is a rise in SSH attacks:
http://www.securityfocus.com/news/11518
One reason for the increase in these attacks could be related to the recent Debian security issues:
http://it.slashdot.org/article.pl?sid=08/05/13/1533212
I remember several years ago I had a similar problem - I was seeing a lot of connections to port 22 on my office Internet connection. The one thing that made the biggest difference was changing the TCP port I used to connect.
I wanted to put up a list of basic tips people can implement, which will make a huge difference regarding these kids of attacks. In the process of double checking my information I found an article that had everything I wanted written up in a very concise manner. Instead of reimplementing thw heel I’m going to link to the article and give a brief summary.
Advanced SSH Tips and Tricks
The most important points in this article are:
CHANGE THE PORT - attackers always check for port 22 and port 23 (SSH and Telnet) if the port isn’t open most attackers are going to go on their way to the next open host.
Implement TCP wrappers - editing your hosts.allow and hosts.deny files is very simple and only takes a minute. it also adds another layer of protection
Firewall rules - make sure your firewall is setup only to allow in the IP addresses you connect from.
The last tip is for advanced home users - when selecting a router for your home based DSL or broadband connections make sure you purchase one that can send all of it’s log messages to another system via syslog. Then install <a href=”http://www.cygwin.com/”>Cygwin</a> and have all of your routers information logged and saved. I’ll have more on the specifics of this in a future post.
Posted in Security, Software, linux | No Comments »