PDA

View Full Version : May Newsletter: RimuHosting Enterprise Linux 4


retep
05-01-2005, 11:53 PM
RimuHosting Enterprise Linux 4
RimuHosting Enterprise Linux 4 is now available as a distro on new orders. It is based on Red Hat Enterprise Linux 4 source RPMs. The distro is very similar to FC3 and WBEL3 just with newer RPMs. We have updated our distro page (http://rimuhosting.com/distros.jsp#rhel4) with more information.

Through April we have been installing some new VPSs with this new distro. So far no problems have been reported after a month of usage by various users. It is our intention to make it our default, recommended distro. We will do this after it has undergone a little more field testing.

It is possible for existing users to switch to the new distro (http://forums.rimuhosting.com/forums/showthread.php?t=77). We would advise waiting another month or two.

Been Hacked Lately?
A number of users have reported unauthorized SSH login attempts on their servers.

There is little you can do to prevent being hit by these login attempts.

But you can do something to prevent them ever succeeding. These ssh break-in attempts are mostly guessing passwords from dictionaries. So ensure that all user accounts on your server have hard-to-guess passwords. For example, combine a couple of words. Or use an acronym fromed from a sentence.

JeffRice
05-21-2005, 09:45 PM
Been Hacked Lately?
A number of users have reported unauthorized SSH login attempts on their servers.

There is little you can do to prevent being hit by these login attempts.

But you can do something to prevent them ever succeeding. These ssh break-in attempts are mostly guessing passwords from dictionaries. So ensure that all user accounts on your server have hard-to-guess passwords. For example, combine a couple of words. Or use an acronym fromed from a sentence.

Even better would be to use public/private key authorization and disable passwords completely.

Additionally, a free log-monitoring product called BFD exists that can blacklist IP addresses that use dictionary attacks, etc.

Jeff

misha
07-19-2005, 02:14 PM
I would recommend to check pam_abl PAM module which I am using for last several weeks. So far I am more then happy with this module. The following link is the module home page:

http://www.hexten.net/sw/pam_abl/

Misha
--

shad
03-23-2006, 06:33 PM
A simple thing you can do is just change the port number you access ssh on. Most hackers probe the default port (22).
Edit your /etc/ssh/sshd_config
and change the port to something else.

Also, a good idea to enable LoginGraceTime
i.e. LoginGraceTime 15
limits the time allowed at the login prompt to 15 seconds before closing the connection.