Re: [gentoo-user] Reaching my network over the internet

[Heinz Sporn <heinz.sporn@sporn-it.com>]

Am Sonntag, den 16.10.2005, 21:27 -0400 schrieb Dave Nebinger:
> On Sunday 16 October 2005 09:18 pm, Nick Rout wrote:
> > no, you just type:
> >
> > ssh my.network.com
> >
> > Depending on your setup you will probably need to set your
> > firewall/router to forward port 22 to the machine you want to log into.
> > Also make sure your ssh server is set up securely.
> 
> This last statement really needs to be highlighted for all of the newbies out 
> there...
> 
> Just opening port 22 will expose your system to attempted break-ins.  If you 
> look at your authorize.log (or relevant log depending upon your syslog 
> config), you'll see after a couple of days different systems accessing ssh an 
> trying to log in as root and/or other users.

Just wanted to second that strongly. I'm hooking up firewalls to the net
pretty much on a daily base. The average time it takes until the first
random port scan hits a brand new box is 15 seconds - at least within
the areas my customers reside. BTW my highscore is 2 seconds ;-)

So running SSH on high-ports plus using RSA for me is pretty much a
must. Anyway - the preferred way to remotely access a box should be via
VPN IMHO.

> 
> Unless you really feel comfortable with your own security infrastructure, your 
> best bet is to edit your /etc/ssh/sshd_config file and change the port number 
> to only something you'd think of in the higher range of port numbers.
> 
> It will still be open, you'll still be able to hit the box from anywhere 
> outside your network, but the different port number ensures that random port 
> scans and breakin attempts will be significantly lower than if you just tried 
> to use standard port #22.
-- 
Mit freundlichen Grüßen

Heinz Sporn

SPORN it-freelancing

Mobile:  ++43 (0)699 / 127 827 07
Email:   heinz.sporn@sporn-it.com
         heinz.sporn@utanet.at
Website: http://www.sporn-it.com
Snail:   Steyrer Str. 20
         A-4540 Bad Hall
         Austria / Europe

-- 
gentoo-user@gentoo.org mailing list