18 Dec
2017
18 Dec
'17
10:53 p.m.
Hi all,
I've just checked and the following servers all allow login via password
(instead of SSH key only). Is anyone actually using this?
I'd recommend to disable all password access and SSH key only or
additionally install sshguard [1] to block brute force attacks.
- libremesh.org
- downloads.libremesh.org
- snapshots.libremesh.org
- more?
Best, Paul
[1] https://packages.debian.org/jessie/sshguard
19 Dec
19 Dec
11:09 a.m.
All of them do not allow root password (PermitRootLogin
without-password), so most of the bruteforce attacks are mitigated.
In addition all of them has fail2ban enabled, so Iptables rules are
added automatically to block brute-force.
Anyway, I just changed PasswordAuthentication to no in all of them so
not even the users are allowed to use password.
Thanks for the advice!
On 18/12/17 23:53, Paul Spooren wrote:
Hi all,
I've just checked and the following servers all allow login via password
(instead of SSH key only). Is anyone actually using this?
I'd recommend to disable all password access and SSH key only or
additionally install sshguard [1] to block brute force attacks.
- libremesh.org
- downloads.libremesh.org
- snapshots.libremesh.org
- more?
Best, Paul
[1] https://packages.debian.org/jessie/sshguard
_______________________________________________
lime-dev mailing list
lime-dev(a)lists.libremesh.org
https://lists.libremesh.org/mailman/listinfo/lime-dev
2332
days inactive
2333
days old
1 comments
2 participants
participants (2)
-
pau -
Paul Spooren