Boston Linux & UNIX was originally founded in 1994 as part of The Boston Computer Society. We meet on the third Wednesday of each month at the Massachusetts Institute of Technology, in Building E51.

BLU Discuss list archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Discuss] vnc

> From: at [mailto:discuss-
> at] On Behalf Of
> markw at
> SSH is a very BAD thing to open up to the free internet. BAD BAD BAD.
> Once in, you are in. Shell access is dangerous.

Blanket statement.

The actual truth is:  SSH *can* be bad to open up to the internet, but it doesn't take rocket science to make it good and secure.

First and foremost, disable all forms of authentication other than key-based.  Even if you have a complex randomly generated password, you'd have to get something like 128-ish bits of entropy into that password to make it secure from brute force attacks.  In that case, you'll never memorize it and you might as well just use keys.  Ensure your keys are 2048 or 3072 bits (or 4096).  Also, by merely allowing password based authentication, script kiddies out there will attempt to brute force attack you.  (Just watch your logs and see.)  This hogs your internet and CPU significantly, even if you have a sufficiently complex password to make yourself actually secure from breach.

Assuming you want to disable password authentication (and everything other than public key)
    This helps you generate a complete list:
        man sshd_config | grep Authentication

    sudo vi /etc/ssh/sshd_config
        Add, or change, the following lines:

        ChallengeResponseAuthentication no
        GSSAPIAuthentication no
        HostbasedAuthentication no
        KbdInteractiveAuthentication no
        KerberosAuthentication no
        PasswordAuthentication no
        PubkeyAuthentication yes
        RhostsRSAAuthentication no
        RSAAuthentication no

BLU is a member of BostonUserGroups
BLU is a member of BostonUserGroups
We also thank MIT for the use of their facilities.

Valid HTML 4.01! Valid CSS!

Boston Linux & Unix /