ssh ServerAlive probes

2011-04-05 Thread Don Tucker
Hello, I am working on an application that needs to be able to rapidly detect a lost connection between an ssh client and ssh server. I am using ssh to do local and remote port forwarding, and sending data across the forwarded ports. I was originally relying upon the TCPKeepAlive probes, bu

Re: a GOOD idea to harden OpenSSH!

2011-04-05 Thread Aaron Toponce
On Thu, Mar 31, 2011 at 03:20:38PM -0300, Christian Grunfeld wrote: > This will not disturb a normal human login with a couple failures but > makes a robot to wait with a potential law. That really isn't the job of OpenSSH, but more for PAM or some other authentication module. Further, there is al

Re: a GOOD idea to harden OpenSSH!

2011-04-05 Thread Lamont Granquist
you can already use fail2ban to accomplish this kind of thing. the original idea i think is somewhat terrible in a multi-user enterprise-y kind of environment since you'll wind up telling users that they have to wait 2 seconds before entering their passphrase constantly. for your home server

Re: a GOOD idea to harden OpenSSH!

2011-04-05 Thread Eric Jaw
Why not utilize OpenVPN to tunnel to the network and allow only local connections made to the ssh server? It solves all my problems. On Apr 2, 2011, at 2:09 AM, "Ward, Jon" wrote: > 1.) Great idea. > 2.) This could be a massive impediment to legitimate automated connections. > Part of a proce