Date: Tue, 29 Dec 2009 22:45:36 +1100 From: Edwin Groothuis <edwin@mavetju.org> To: "Andresen, Jason R." <jandrese@mitre.org> Cc: "freebsd-stable@freebsd.org" <freebsd-stable@freebsd.org>, Chris H <chris#@1command.com> Subject: Re: Hacked - FreeBSD 7.1-Release Message-ID: <20091229114536.GA2409@mavetju.org> In-Reply-To: <600C0C33850FFE49B76BDD81AED4D25801371D8737@IMCMBX3.MITRE.ORG> References: <bd52e0bd614fbaffcf8c9ff9da35286e@mail.isot.com> <4B20B509.4050501@yahoo.it> <600C0C33850FFE49B76BDD81AED4D25801371D8056@IMCMBX3.MITRE.ORG> <ce92ed41260c438977298c2cf9dd1e3f.HRCIM@webmail.1command.com> <600C0C33850FFE49B76BDD81AED4D25801371D8737@IMCMBX3.MITRE.ORG>
next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, Dec 28, 2009 at 10:44:41AM -0500, Andresen, Jason R. wrote: > The point is, if your machine is on the internet, then bots are > going to try password attacks on any open port they can find. It's > just the sad fact of life on the current internet. Unfortunately, > this activity will also make it much more difficult to determine > when you are under attack from an actual person, which was my point > earlier. It's one that is not going to be easy to solve either, > unless you're willing to rewrite SSH to require every connection > attempt to pass a Turing test or something. On all systems which need to be accessible from the public Internet: Run sshd on port 22 and port 8022. Block incoming traffic on port 22 on your firewall. Everybody coming from the outside world needs to know it is running on port 8022. Everybody coming from the inside world has access as normal. Edwin -- Edwin Groothuis Website: http://www.mavetju.org/ edwin@mavetju.org Weblog: http://www.mavetju.org/weblog/
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20091229114536.GA2409>