Thread: A couple more SSH / VNC questions
View Single Post
Benson's Avatar
Benson is offline Benson
2008-04-10 , 16:17
Posts: 4,930 | Thanked: 2,272 times | Joined on Oct 2007
#38
Originally Posted by cmdowns View Post
What is the opinion of the gurus regarding the potential threat of brute force attacks to an SSH server? It certainly seems possible for a automated assault to access my machine's port 22 by forcing an SSH tunnel through a brute force/dictionary style attack? How significant of a threat is this and is the installation of something similar to DenyHosts something that should be included in our setup as it has thus far been described?
Well, DUH! (Not you, me.) I completely forgot about auth...


I had meant to suggest that you use public-key authentication, and disable password authentication. Then I forgot.

Yes, denyhosts actually looks like a pretty good idea, even with password auth disabled. One thing to think about: while different thresholds for valid/invalid users seems sane, given the differences in probability that it is a crack attempt, it does disclose information about valid usernames. This may be helpful to an attacker with multiple IPs, whether DHCP, AP roving, or a botnet.
The wiki that I reference at the beginning of this post deals with establishing the ssh tunnel to an sshd server running on a Linux machine, and then establishing the VNC session through that tunnel. More or less identical to what we've been describing, except that we've been connecting to a machine with an XP OS. Likewise, DenyHosts is a Linux app. Is it possible to implement it in Cygwin? Or, is there something similar (or for that matter, something completely different) that will help to protect the system's port 22 against this type of attack?
Specifically, it's a Python app. Cygwin has a Python interpreter, so it should work. Networking is a bit of an odd mix, but I think it should work. Worst case, you have to rig up a patch to Windows Firewall, but I think tcp_wrappers works.

But brute-forcing an RSA key is hard enough you don't really need denyhosts, as long as you forbid password auth.