Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Secure-Shell
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

Re: shutting down dictionary attacks

from [Brian J. Woods] Network Security [Permanent Link]
Subject: Re: shutting down dictionary attacks
Date: Mon, 04 Jul 2005 03:08:21 -0500 
Josh Grosse wrote:

I run OpenBSD 3.7  with OpenSSH 4.1, and found that even with:

        PermitRootLogin no
        PasswordAuthentication no
        Protocol 2
        ChallengeResponseAuthentication no

Using OpenSSH or Putty from test PCs, I couldn't supply a password, but the
script kiddies were still finding a way to make password attacks. Obviously,
their skills are certainly better than mine.

Searching The Fine Archive, I found http://marc.theaimsgroup.com/?l=secure-shell&m=109755336414758&w=2

which suggests

        PAMAuthenticationViaKbdInt no

as an additional config setting.  It's not applicable to OpenSSH 4.1
on OpenBSD. But, poking through sshd(8) I found:

        KerberosOrLocalPasswd no

After adding that to my config, it *seems* like my attacks may have been stopped. At least, they're no longer being logged.

Any thoughts on whether this change will be effective, or if this was just
serendipitous?

  -Josh Grosse-



Apologies about the last reply.
More info on the environment the PCs are in is probably needed.

[More with this subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  Re: shutting down dictionary attacks, Guillaume Vissian
Next by Date:  Re: shutting down dictionary attacks, Josh Grosse
Previous by Thread:  Re: shutting down dictionary attacks, Josh Grosse
Next by Thread:  Re: shutting down dictionary attacks, Bartosz Krajnik
Indexes:  [Date] [Thread] [Top] [All Lists]