Ethical Hacking Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package. | Computer Forensics Training at InfoSec Institute Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors. |

| Subject: | Re: Is this normal? |
|---|---|
| Date: | Thu, 21 Oct 2004 21:51:58 -0500 |
More than likely this is just some script kiddie behavior. If you are using safe passwords (you do use software to attempt to crack/guess those passwords yourself, right?) the only worry is that some exploit for sshd or another exposed program will come up before you patch it. Consider your actual requirements for using sshd as this is a home system where you could just walk over and log into the box directly. If sshd is required be sure to block ports on your boxes behind this one. Another relatively decent home network security tip is to turn off systems that you are not using. Most of them do not need to be on, and can be turned on overnight to apply updates as needed. As for your other questions: This is relatively normal methodology for a script kiddie login attempt. If you were able to look at the usernames and passwords used it would probably consist of a lot of root:$easytoguesspassword entries. Sshd attacks are fairly uncommon in the windows ubiquitous world of home networking. You should not really be concerned. As long as you are using strong passwords and keeping your software up to date everything should be golden. Someone capable of more than just mindless login attempts might be able to do some damage, but that is not what you are seeing here. Like I said earlier seriously consider disabling sshd, or at the least limiting access from specific ranges. Ensure that you are not able to remotely login as root. Use software like john the ripper to test your passwords, and change them often. I don't know a whole lot about linux, so I cannot give you any hardening/any other advice. Hope this helps though. -Adam
| <Prev in Thread] | Current Thread | [Next in Thread> |
|---|---|---|
| ||
| Previous by Date: | Re:Secure Port Testing, Ghaith Nasrawi |
|---|---|
| Next by Date: | RE: VPN in debian: L2TP/IPSec? PPTP? ...?, Ghaith Nasrawi |
| Previous by Thread: | Re: Is this normal?, Kenneth R Swain II |
| Next by Thread: | Re: Is this normal?, Callan K L Tham |
| Indexes: | [Date] [Thread] [Top] [All Lists] |