Re: [Full-Disclosure] Re: Any update on SSH brute force attempts?

[Tim <tim-security@xxxxxxxxxxxxxxxxxxx>]

> And the few present users attempted:
> adm
> apache
> nobody
> operator
> root


In addition to what others have suggested, you could use PAM to enforce
account lockouts in the event that the attacker does focus the attempts
on a real account.  The Linux module for this is pam_tally.  You can
also put an unlock script on a cron job to then prevent DoS of all of
your accounts.  Not perfect, but effective.

hth,
tim

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html