openssh concerns

[Eric Williams]

On 10/3/2009 7:18 AM, olli hauer wrote:
>>> http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers
>>> provides a 
>>> reasonably useful list of ports NOT to choose for an obscure ssh
>>> port.
>>
>> In practice, you have no choice but to use someting like 443 or 8080,
>> because corporate firewalls often block everything but a small number
>> of
>> ports (usually 20, 22, 80, 443, 8080, and odds are that 20, 80 and
>> 8080
>> go through a transparent proxy)
> 
> This may work if the firewall does only port and no additional protocol
> filtering. For many products used in corporate envirion it is even
> possible to filter ssh v1, skype, stunnel, openvpn with a verry high
> success rate within the first packet's on the wire.
> 
> In case for the ssh server take a look into this parameters
> - LoginGraceTime
> - MaxAuthTries
> - MaxSessions
> - MaxStartups

The absolute best way to filter out the attacks is to disable
authentication methods other than public keys. Obviously this isn't
possible in all situations, but it's very effective. Most attack bots
will just disconnect when they attempt login, and it's almost impossible
to crack a key and gain access.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: OpenPGP digital signature
Url : http://lists.freebsd.org/pipermail/freebsd-security/attachments/20091003/cfcb2488/signature.pgp