Re: [Snort-sigs] SSH Scans

Frank Knobbe wrote:
> In case specifically for SSH, sure, there's room to play. My caution was
> for general threshold rules. Single IP != Single User  :)
>
> In regards to SSH, though, I would restrict access to SSH with (a)
> firewall(s) to those locations that need to log in. (insert your
> favorite prevention-cure-quote here ;)  That way you don't even open
> yourself to SSH brute force attacks.
>
> Then, having limited the scope for the rule through firewall ACLs, you
> can probably even better tune the threshold values.

Ya, that'd be nice. I don't control all the nets we monitor though. I 
can recommend till I'm blue in the face, but things like that often 
don't get done. :)

You're definitely right though. If can have a set number of sources you 
should control access. Just like a term server. :)

Thanks Frank.

Matt


-------------------------------------------------------
SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media
100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33
Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift.
http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs