> From: discuss-bounces+blu=nedharvey....@blu.org [mailto:discuss-
> bounces+blu=nedharvey....@blu.org] On Behalf Of
> ma...@mohawksoft.com
>
> SSH is a very BAD thing to open up to the free internet. BAD BAD BAD.
> Once in, you are in. Shell access is dangerous.
Blanket statement.
The actual truth is: SSH *can* be bad to open up to the internet, but it
doesn't take rocket science to make it good and secure.
First and foremost, disable all forms of authentication other than key-based.
Even if you have a complex randomly generated password, you'd have to get
something like 128-ish bits of entropy into that password to make it secure
from brute force attacks. In that case, you'll never memorize it and you might
as well just use keys. Ensure your keys are 2048 or 3072 bits (or 4096).
Also, by merely allowing password based authentication, script kiddies out
there will attempt to brute force attack you. (Just watch your logs and see.)
This hogs your internet and CPU significantly, even if you have a sufficiently
complex password to make yourself actually secure from breach.
Assuming you want to disable password authentication (and everything other than
public key)
This helps you generate a complete list:
man sshd_config | grep Authentication
sudo vi /etc/ssh/sshd_config
Add, or change, the following lines:
ChallengeResponseAuthentication no
GSSAPIAuthentication no
HostbasedAuthentication no
KbdInteractiveAuthentication no
KerberosAuthentication no
PasswordAuthentication no
PubkeyAuthentication yes
RhostsRSAAuthentication no
RSAAuthentication no
_______________________________________________
Discuss mailing list
Discuss@blu.org
http://lists.blu.org/mailman/listinfo/discuss
