ALERT - Online.net clients are being attacked and infected with XOR.DDOS

Comments

• doughmanes Member

  August 2015

  ksug said: Changing SSH port is security by obscurity. If the attacker scans ports, it slows down the attacker by 3 seconds. It doesn't prevent anything.

  Guess you don't deal with this daily with a VPS node and how many services running on it. "Obscurity" works for 'dumb' bruteforcing malware that makes a bunch of noise and not this overly security crap when something basic as this will help people 99.9% of the time.
• ksug Member

  August 2015

  @doughmanes said:
  Guess you don't deal with this daily with a VPS node and how many services running on it. "Obscurity" works for 'dumb' bruteforcing malware that makes a bunch of noise and not this overly security crap when something basic as this will help people 99.9% of the time.

  What I do or do not deal with is irrelevant. Others have argued about reducing the size/noise of the log file, I don't disagree with that.
  The "99.9%" figure is not supported by any evidence. I don't rely on the attackers being dumb. If attackers are dumb, we have nothing to worry about.
• Nomad Member

  August 2015

  @rm_ said:
  (I was so fed up fixing this on new RunAbove instances, I even wrote a script to re-enable 'root' automatically...)

  In case your key file is grabbed, having an extra security level is not that bad a choice.

  Use the key file for logging into a chrooted user then su your way in to root. There's justification.
• rm_ IPv6 Advocate, Veteran

  August 2015

  Nomad said: In case your key file is grabbed

  It is password-protected, so nobody can just use it either.

  Nomad said: Use the key file for logging into a chrooted user then su your way in to root.

  Silly monkey's work.
• hostnoob Member

  August 2015

  @darknessends said:
  doughmanes, it won't take very long for an attacker to find your ssh port.

  but these bots just mass scan port 22, they don't specifically target certain servers

  that's what changing the default port helps protects against.
• hostnoob Member

  August 2015

  @doughmanes said:
  Like what?

  only root can start services on ports 1-1024 so if a service is running on port 22, you know it was started by root, and not another user running a fake daemon

  of course another user running a fake daemon on your SSH port would mean access to your server has been compromised so you're probably fucked anyway which is why I think that's a load of rubbish
• Nomad Member

  August 2015 edited August 2015

  @rm_ said:
  Silly monkey's work.

  Depending on the use, I disagree with you.
  For example you can set your ssh client to autologin on your pc/phone to quickly access to ssh instead of typing passwords all the time. In such cases root login is a bad idea. In case your phone or pc gets stolen/peeked.

  Just cause it's not the way you are used to doesn't make it a bad practice or a silly monkeys work.