UNC Linux Users Group

[hays AT ibiblio.org]

We use a modified version of sshd, that calls a script and locks out an 
attacker after x number of failed logins via a given ip:
<http://wwwx.cs.unc.edu/%7Ehays/dev/timelox_and_TheHand/>

--On February 27, 2008 5:10:29 PM -0500 Scott Zentz <zentz AT email.unc.edu> 
wrote:

> IMHO opening ssh to the world is a bad idea... SSH is encrypted and uses
> authentication but if you open up your attack vector to the world then
> you would be susceptible to any 0 day exploit that applies to ssh (known
> and unknown)... Not to mention the constant dictionary based attacks that
> script kiddies use on a daily basis... 99.999 percent of the dictionary
> based attacks don't work and just create more traffic on the network but
> it's still an attack and eventually someone will get in...
>
> -scz
>
> Andrew Perrin wrote:
> > Why use hosts.allow? If it's only ssh accessible it should be safe to
> > open  up and just require authentication.
> >
> > Alternatively, if you want people to be able to ssh in from all wireless
> > UNC addresses, use
> >
> > .wireless.unc.edu
> >
> > Again, because it's ssh, they'll still have to authenticate once they
> > connect.
> >
> > ----------------------------------------------------------------------
> > Andrew J Perrin - andrew_perrin (at) unc.edu -
> > http://perrin.socsci.unc.edu Associate Professor of Sociology; Book
> > Review Editor, _Social Forces_ University of North Carolina - CB#3210,
> > Chapel Hill, NC 27599-3210 USA
> >
> >
> >
> > On Wed, 27 Feb 2008, dsandif wrote:
> >
> >
> > > Question:
> > >
> > > I have a linux project server that I have set too be accessible only by
> > > SSH. It is static IP'ed so if anyone wants to get access within the
> > > department subnet, I have to add their IP to the hosts.allow file.
> > > However, I also want wireless users to be able to access the project
> > > server files as well and being that the wireless network is dhcp, I'm
> > > not sure as to how to go about this. If I try to access the server via
> > > wireless, I do get a contact registered from both the host and the
> > > client but then I get a "ssh_exchange_identification: Connection closed
> > > by remote host" on the client and on the server security logs, it comes
> > > up as a dhcp wireless client denied. Is there a way to do this so that
> > > folks that use wireless in my building can get access?, thxs.
> > >
> > > D-
> > > _______________________________________________
> > > unclug mailing list
> > > unclug AT lists.ibiblio.org
> > > http://lists.ibiblio.org/mailman/listinfo/unclug
> > _______________________________________________
> > unclug mailing list
> > unclug AT lists.ibiblio.org
> > http://lists.ibiblio.org/mailman/listinfo/unclug



--

________________________
bil hays
Network Manager
Computer Science, UNC CH