[ILUG] Possible hack?

[Anders Holm]

Well, limiting the number of hosts that can access your system would actually be a good idea.

Here's why... It all boils down to what hosts you want to trust. Any host you do trust, should be allowed in, any other 
host should be blocked from even having a chance to login, right? So, limiting the number of hosts that you allow, 
would enhance your security.

What if someone hacked another box, that happens to have your key on it (why is another question, but hey..) That 
machine is not generally one that _should_ be trusted because it's not on your network, but you still have access to it, 
hence why the key is there. I wouldn't consider a machine outside my own network to be trusted unless there was 
some good reason for it to be so. Limit the trusted hosts, and you've _possibly_ blocked that problem.

System security is _all_ about making it _harder_ for hackers, and should have _few_ elements in the means of 
making "dead easy" for admins. As an admin, some pains will remain in order for system security to be sucessfull, 
right? SSH is a great tool, and it could enhance your security further. Why would you want to allow access for  people 
in Russia or China for example? 

Putting in place a proper procedure of getting access from a host which you normally don't use is the next step. 
Remember, you want to keep your system safe, right? Allowing Joe Bloke to even get to "password please" isn't 
acceptible, since that at least allows him to try brute force attacks on your passwords.

Well, reading that book didn't help, did it? ;)

//Anders//

-----------------
>Quoting Barry O'Donovan (barry.odonovan at ucd.ie):
>
>> I'll look around some more but won't waste too much time on it. I'm 
>> going to do a complete reinstall and upgrade to RH7.3. As has been 
>> suggested I'll limit the number of hosts that can ssh in and lock 
>> down everything else that I can.
>
>I'm not sure that "limiting the number of hosts that can ssh in" is
>particularly useful.  Let us say that you set up your hostaccess files
>so you can ssh in from _only one_ IP address, which happens to be the 
>only IP address you ever use.  I would submit that you've not increased
>your security by iota, though you've shot flexibility in the foot.
>
>Consider:  Since this is ssh access, no security tokens are exposed
>en-route, only at each end.  The only remote exposure is therefore on
>the host where the ssh client software is.  The "security measure" you 
>took is simply not relevant.  (However, if you have an emergency need to 
>ssh in from an unfamiliar IP, it's relevant in the sense of locking you
>out completely, absent a two-stage ssh via the allowed host -- which, of
>course, weakens security considerably by introducing _additional_ attack
>points.)
>
>There's a lot of really bad security advice available from people who
>don't think clearly about attack models.  May I recommend Bruce
>Schneier's book _Secrets and Lies_ as an excellent innoculation of
>common sense in this area?
>
>-- 
>Cheers,   The difference between common sense and paranoia is that common sense
>Rick Moen     is thinking everyone is out to get you.  That's normal; they are.
>rick at linuxmafia.com      Paranoia is thinking they're conspiring.  -- J. Kegler
>
>-- 
>Irish Linux Users' Group: ilug at linux.ie
>http://www.linux.ie/mailman/listinfo/ilug for (un)subscription information.
>List maintainer: listmaster at linux.ie