Another thing you can do is to have SSH listen on a port other than 22. I moved mine up into the 20000 range. Most people scan only on well known ports (FTP, WWW, SSH, SMTP, etc) so if they don't find anything they move on, plenty of vulnerable systems out there, why waste time scanning one that doesn't appear to be online, and if it is is probably well protected.
S >From: John Desmond <[EMAIL PROTECTED]> >To: [EMAIL PROTECTED], LEAF User List <[EMAIL PROTECTED]> >Subject: Re: [Leaf-user] An ssh attack against ESb2 >Date: Thu, 14 Feb 2002 12:24:36 -0800 (PST) > >Right you are. And I just tightened it up to only the >one external location I really want to access it from. >Too bad that newer OpenSSL is *so-o-o* big. I can't >fit it. >-John > >--- "Glenn A. Thompson" <[EMAIL PROTECTED]> wrote: > > hey: > > > > Jeff Newmiller wrote: > > > > > On Sun, 27 Jan 2002, John Desmond wrote: > > > > > > > I just picked the following off my ESbeta2 a few > > > > minutes ago. It claims a "crc32 compensation > > attack" > > > > was made against it. It went on for about 1/2 > > hour. Is > > > > it significant that the source port changes with > > every > > > > connection attempt? > > > > I have sshd set up to receive connections from > > two > > > > external IPs (EXTERN_TCP_PORTS="0/0_ssh <2 > > locations>" > > > > Doesn't "0/0_ssh mean that the whole world can > > connect to port 22 not just two > > hosts? > > > > Glenn > > >__________________________________________________ >Do You Yahoo!? >Send FREE Valentine eCards with Yahoo! Greetings! >http://greetings.yahoo.com > >_______________________________________________ >Leaf-user mailing list >[EMAIL PROTECTED] >https://lists.sourceforge.net/lists/listinfo/leaf-user _________________________________________________________________ Join the world�s largest e-mail service with MSN Hotmail. http://www.hotmail.com _______________________________________________ Leaf-user mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/leaf-user
