beginner with hacked openssh box, please help!

[igorzwx]

old Unix hackers tend to use this method to restrict access to SSH server
http://en.wikipedia.org/wiki/MAC_address

[jerome1232]

This is true, hence moving your SSH server to some other port decreases the number of login attempts massively. I also used to get hundreds or thousands of login attempts a day (most of them from China), so I started using sshblack, but really the fastest and easiest cure is to use a non-standard port.

Meh they are just bots using dictionary attacks. If someone was actually trying to get in they would just port scan you. All moving the port does is clean up your logs.

I mean seriously I saw one bot was going through the alphabet trying users (A B C etc..). I'll bet the passwords it was trying were the same as the user names it was trying.

[igorzwx]

1. What Every Web Programmer Needs To Know About Security - Google ...
   
   Skip to page content Skip to main navigation. Google Code ... the book "Foundations of Security: What Every Programmer Needs To Know" for use by instructors ...
   code.google.com/edu/submissions/daswani/index.html - Cached - Similar
2. Web Security - Google Code University - Google Code
   
   Skip to page content Skip to main navigation. Google Code ... of the chapters in the book "Foundations of Security: What Every Programmer Needs To Know" for ...
   code.google.com/edu/security/index.html - Cached - Similar
3. APRESS.COM : Foundations of Security: What Every Programmer Needs ...
   
   Click the Google Preview image to preview this book! If you wish to preview other books, check this listing. Book Details. Foundations of Security: What ...
   www.apress.com/book/view/9781590597842 - Cached - Similar

[bodhi.zazen]

Meh they are just bots using dictionary attacks. If someone was actually trying to get in they would just port scan you. All moving the port does is clean up your logs.

I mean seriously I saw one bot was going through the alphabet trying users (A B C etc..). I'll bet the passwords it was trying were the same as the user names it was trying.

I agree but changing the default port gets rid of 90 % + of the script kiddies as they are called and performing a port scan is taking the game to another level, and port scanning can get very sophisticated.

A well configured set of iptables will help a ton with port scans.

[quixote]

Thanks again to all for the further ideas. I'm getting a whole toolchest for future reference. First (and easiest) I'll definitely be using a nonstandard ssh port. A good idea, even if it's not perfect. After all, in this game it's not so much a matter of being invulnerable as of being less vulnerable than the next guy.

[bodhi.zazen]

Thanks again to all for the further ideas. I'm getting a whole toolchest for future reference. First (and easiest) I'll definitely be using a nonstandard ssh port. A good idea, even if it's not perfect. After all, in this game it's not so much a matter of being invulnerable as of being less vulnerable than the next guy.

Security is like an onion - It has layers and they stink

[kevdog]

Why does security stink? Couldn't it be related to petals on a rose instead?

[koenn]

if it stinks, you're doing it wrong ...