Once again.... this does not lower the risk or make it more difficult for the hacker as the level of security is not raised, it might just lower the chance. Best protection for SSH is (still) public private keys, read more about this in the wiki: http://wiki.contribs.org/SSH Public-Private Keys.
I would like to ask you, once again, to refrain from posting posts like this in the forum as this gives users a false positive feeling on security. Your advice is more or less comparable with moving to a big city from a tiny village, you'll be less likely to be found, but you can still be found.
Some months, or a year ago I deceided to try to do something to improve the security of my SME server. One thing that worried me a bit was that the log showed thousands of hacking attempts on regular basis. Specially the web server log showed a lot of hacking attempts. With some of my old but still usable php applications, I did not like it to much.
To improve security a bit a decided to redesign things a little bit, so a rather changed over to run the SME server as a virtual installation on Centos 5.3 with also a virtual installation of Smoothwall, both installations runned on the same box. The only public available server function is now sshd on a unstandard port and standard password login. All other server functions is only available from approved ip adresses.
From some thousands on regular basis, has the number of attacks against the SME server now been lowered to a total of zero attacks over a period of 6 monts connected to internet.
As I will see it hacking attempts is something that has to be buildt up over time. Before real hacking attemptes there will always be some preactivity.
My personal opoinion is that when you can look into your logs on regular basis, and you can se that there is absolute zero atempts to breake in, and zero hacking attempts, you actually, as I will see it has improved security.
I think anyone working with or dealing with computer security should have their own right to have their own meaning. According to my opinion hacking will normally require some observable preactivity. As long as the number of atempts is zero over time and all preactivity is equal to zero, the security is according to my opinion OK. Other persons should be free to mean that redusing the nuber of attemts to zero over time and also reduzing all preactivity to zero, has nothing to do with security, but I think is has something to do with security.
It should be possible to respect each other different point of view on such a case. As I will se it mathematical propability is a quite important factor in security work. Whe there is thousands of attempts there is a risk. As long as you can monitor and see that there is zero attempts over time, the statistical chanse of beeing hacked has, as I will see it, been reduced.
I feel that my installation is safe as long as monitored hacking preactivity is zero. Other might be free to say that I am not correct and that my installation is unsafe.
There is some printed publications on network security, as an example Hacking Exposed. I think this book actually will give me right (??!!) Actually it was the recomendations from this book I used for the security redesign.
groyk ->
No I am not a programmer at all myself, and certainly not on MS platform. I thing it is very positive that someone try to come up with some new ideas some times.
9 Replies
3127 Views