Skip to Content.
Sympa Menu

unclug - Re: [unclug] ssh via wireless...

unclug AT lists.ibiblio.org

Subject: UNC Linux Users Group

List archive

Chronological Thread  
  • From: hays AT ibiblio.org
  • To: UNC Linux Users Group <unclug AT lists.ibiblio.org>
  • Subject: Re: [unclug] ssh via wireless...
  • Date: Fri, 29 Feb 2008 15:33:02 -0500

We use a modified version of sshd, that calls a script and locks out an attacker after x number of failed logins via a given ip:
<http://wwwx.cs.unc.edu/%7Ehays/dev/timelox_and_TheHand/>

--On February 27, 2008 5:10:29 PM -0500 Scott Zentz <zentz AT email.unc.edu> wrote:

IMHO opening ssh to the world is a bad idea... SSH is encrypted and uses
authentication but if you open up your attack vector to the world then
you would be susceptible to any 0 day exploit that applies to ssh (known
and unknown)... Not to mention the constant dictionary based attacks that
script kiddies use on a daily basis... 99.999 percent of the dictionary
based attacks don't work and just create more traffic on the network but
it's still an attack and eventually someone will get in...

-scz

Andrew Perrin wrote:
Why use hosts.allow? If it's only ssh accessible it should be safe to
open up and just require authentication.

Alternatively, if you want people to be able to ssh in from all wireless
UNC addresses, use

.wireless.unc.edu

Again, because it's ssh, they'll still have to authenticate once they
connect.

----------------------------------------------------------------------
Andrew J Perrin - andrew_perrin (at) unc.edu -
http://perrin.socsci.unc.edu Associate Professor of Sociology; Book
Review Editor, _Social Forces_ University of North Carolina - CB#3210,
Chapel Hill, NC 27599-3210 USA



On Wed, 27 Feb 2008, dsandif wrote:


Question:

I have a linux project server that I have set too be accessible only by
SSH. It is static IP'ed so if anyone wants to get access within the
department subnet, I have to add their IP to the hosts.allow file.
However, I also want wireless users to be able to access the project
server files as well and being that the wireless network is dhcp, I'm
not sure as to how to go about this. If I try to access the server via
wireless, I do get a contact registered from both the host and the
client but then I get a "ssh_exchange_identification: Connection closed
by remote host" on the client and on the server security logs, it comes
up as a dhcp wireless client denied. Is there a way to do this so that
folks that use wireless in my building can get access?, thxs.

D-
_______________________________________________
unclug mailing list
unclug AT lists.ibiblio.org
http://lists.ibiblio.org/mailman/listinfo/unclug


_______________________________________________
unclug mailing list
unclug AT lists.ibiblio.org
http://lists.ibiblio.org/mailman/listinfo/unclug




--

________________________
bil hays
Network Manager
Computer Science, UNC CH




Archive powered by MHonArc 2.6.24.

Top of Page