| |
| |
| |
|
Page: 1 2
Comments:
<0> how would i secure sshd to only allow three login attempts, then ban an IP?
<1> #webavant you could use http://denyhosts.sourceforge.net/
<2> hrm
<2> he's not in here but i'm going to check that out for myself
<3> kitchen: iptables and the recent module
<2> i mean, idon't really care if they try, it's just annoying to see it spamming up my logs
<3> http://www.linux-noob.com/forums/index.php?showtopic=1829 here
<3> iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --set
<3> iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 -j DROP
<3> done :)
<3> 3 new connections in a minute.. and it will terminate the connection
<2> znx: that's 4 connections in 60 seconds and it drops it?
<2> even if they're legit?
<3> er yeah 4..
<3> YES
<2> yea
<2> that's not helpeful
<3> well it is for me
<2> i use svn over ssh
<3> thats fine
<2> i have backup scripts that use scp
<3> one ssh connection.. then it pipes
<2> i have all kinds of legit ssh connections all the itme
<3> yeah but its only down to the number of NEW connections
<2> well these processes are all creating new connections
<3> set it to the max number then?
<2> and if i block myself from ssh i'm ****ed
<2> :)
<3> hehe
<3> it does unban
<2> especially if it goes anal and kicks my existing connections off
<2> yes, but after a period of time, and i can't really get in to unban it manually, right/
<3> true
<3> kitchen: but equally.. is my solution
<3> no p***word auth at all
<3> http://www.abdn.ac.uk/~fac075/?howto+ssh
<3> kitchen: here is a nice idea..
<3> whitelist your known iptables.. and use the recent limiting on all others?
<3> like:
<2> i'm too lazy for any of that :P
<3> iptables -A INPUT -j WHITELISTSSH
<3> well .. pfft :P
<3> hehe
<2> unless a remote root exploit comes out for ssh, or i start allowing users to set insecure p***words, i'm pretty safe
<3> true
<3> saying all that
<3> @work we still run telnet ..
<3> externally
<3> heh
<2> wtf
<2> are you kidding?!
<2> please tell me you're kidding
<3> no i am not
<2> WHY
<2> omg using telnet .. ugh
<3> we even just rebuilt the server.. brand new from scratch..
<3> installed telnet..
<3> hehe
<2> might as well just put your root p***word in your telnet banner
<3> :))
<2> seriously though, why the **** are you still using telnet for external access
<3> apparently pissing off the legions of telnet users is too great a cost
<3> kitchen: we even run sshd .. so its there..
<2> if anything, EXTERNAL access should be even MORE secure
<3> yup
<2> znx: so why not just shut telnetd off
<2> it's not like there aren't ssh clients available for every conceivable OS
<3> because there are servral lecuters who dont know how to use putty..
<2> dude
<2> ;|
<3> i know this
<2> ok so you work at a university?
<3> ive complained ..
<3> yeah im a computer operator for aberdeen uni
<2> AN EDUCATOIN SYSTEM THAT CAN'T EDUCATE ITSELF?!
<3> heh
<2> that reminds me of the company i worked for in indy
<2> it was an isp
<3> !google aberdeen university
<3> bah
<3> http://www.abdn.ac.uk
<2> a t1 connecting some dialup in BFE would go down, the level 2 guys would know about it
<2> and lal of us in tech support would be clueless, so here we are wasting time trying to help people
<2> then we get enough calls from an area, go ask level 2 and they're like "oh yea, that's down"
<3> heehehe
<2> so i was always like
<2> it's real simple
<2> you OPEN A ****ING EMAIL
<3> we get that all the time too..
<2> TYPE
<3> haha
<2> T1 IN MAHOMET IS DOWN
<2> PRESS CTRL-ENTER
<2> DONE
<2> oh man
<3> one of the best things that happened for us..
<2> i hated that ****ing job
<3> three admins walked p***ed us.. and into the machine room..
<3> turned off two of the ugrad servers.. and began working on them
<3> so we get a huge stream of students.. lots of issues..
<3> and we are phoning along the corridor.. saying where are they all!!!
<3> and here they are .. in the machine room.. just next door..
<3> aholes never bothered to schedule the shutdown
<3> last time they ever got away with it though.. my boss went nuts on them
<2> did tey even let yo know it was coming?
<3> nope
<2> i went up the chain bitching about this dude
<3> walked past us into the roomo
<2> the problem was that there were 7 people in tech support
<2> and the 'tech support manager' bitch hadn't taken a ****ing tech support call in her life
<3> hehe
<2> so i told her the situation and she was clueless
<2> i was like
<2> look
<2> when someone knows something is down
<2> tech support should be the FIRST ****ING PERSON THEY TELL
<2> because we field the calls from the customers
<2> if we can simply say "it's down, our admins are working on it" saves us a lot of stress
<3> and the users as well..
<2> if i spend like 20 minutes trying to get some ****nut's dialup working and it's just that the ****er is down
<2> i'm gonna be pissed
<2> yea and the users
<2> we found out we had a fax machine with a direct outside line in our part of the office
<2> so i rigged up a splitter and ran 7 phone lines
<2> we all had modems in our cmputers
<2> now we could dial out directly
<2> and try the term server ourselves
<3> nice ..
<2> saved a bit of trouble but still.. just.. ugh
<3> we just got a line in for testing the dialup..
<2> well
<2> they found out about it and wanted to take it out
<3> but that was because people were turning up with machines..
<2> i told them if they took it out i was leaving
<2> and we were getting slammed with calls that day
<3> hehe
<2> so, it stayed in.
<3> :)
<3> you still working there?
<2> there was a modem on the network we were supposed to use
<2> but we couldn't HEAR the modem speaker
<3> oh no.. said did work there..
<2> and you know how windows is about error messages
<3> yeah and Error occured in an unknown module!
<2> i was like "I have to be able to hear what's going across the line"
<3> nice..
<2> yea
<2> and no, I don't work there
<2> this was 3-4 years ago
<3> what you do now?
<2> I'm a perl developer
Return to
#redhat
or
Go to some related
logs:
#flash
#sex
#debian
#sql
e2161 RLink32
#windows
fuck checkpoint
#sex
#narcotics
#stocks
|
|