tightening ssh

[Danny Howard]

On Sat, Nov 19, 2005 at 10:41:52AM -0500, Tony Nelson wrote:

> Port obscurity is not much of a strategy.  Maybe the current scripts don't
> try other ports, but it would be simple enough to add a port scan and then
> probe all open ports.  Expect it.

The only "advantage" I see to a different port is a slightly reduced
performance impact from brute force attempts, and cleaner incidence
logs.

> I suggest one of the secure ways to set up SSH:  public key pair or
> encrypted passwords.  And only allow SSH 2.  Public key should be simple
> /enough/ to set up; your user would need to make a key with GPG and put the
> private key in the right place (I think man ssh tells where) and give you
> the public key to put in the right place.

Someone mentioned to me in passing the other day, that you can have sshd
require both a key, and password authentication.  Which sounds kind of
neat, because then you don't have to trust that the user has a password
on their key. :)

Cheers,
-danny

-- 
http://dannyman.toldme.com/