Salut, keith@xxxxxxxxxxxxxx,
On Tue, 12 Feb 2008 08:17:13 -0500 (EST), keith@xxxxxxxxxxxxxx wrote:
> been using since begining of project, but requires a lot of learning
> to setup properly" and as I stated nothing is foolproof or totally
> secure. Other measures need deployed as well such as an application
I would not suggest that I have not set it up correctly, because it
recognized all the background noise attack patterns just well (and did
not notify), but nevertheless it was totally incapable of detecting
anything which could really have been interesting.
> It takes quite a bit of heat and even then some data can be
> recovered, from magnetic residue, in labs. Usually cost prohibitive
> unless someone really wants your data bad and has a big budget.
>
> But please state a config that someone with experience can not get
> into, is more of a point that security is ever evolving.
Well, you can take Flash storage and put 300-400V or so at the
contacts - just enough to melt the core before the contacts. If the
voltage is too high, only the contacts melt away and the core stays
intact. That is the only really erasable medium I'm aware of.
An alternative for the longer term is a PGP smart card with an 8192 bit
RSA (not! DSA) key which you simply break apart as you get into
trouble. It takes a while to reverse engineer the data.
But as I said, this is pure populism, servers are here to serve, not to
be made inaccessible. It is possible to maintain reasonable security
without achieving unusability.
> Yup it is security by obscurity and it will help against a script
> kiddie that won't take the time to scan all ports, thats why I
> suggested move to a high non-standard port.
That script kiddie won't find its way into a reasonably maintained
server anyway, it takes someone clued to do it.
> I'm not talking about downloading blacklists but dynamic firewall
> rules and scripting to achieve a dynamic list based on ranking of
> attacks against the box. Google does have a few references and
Me too; there are e.g. scripts which evaluate failed logins from syslog
and ban them. Thus the mention of the user name with spaces, some of
these scripts fall for that trick.
Tonnerre
--
SyGroup GmbH
Tonnerre Lombard
Solutions Systematiques
Tel:+41 61 333 80 33 Güterstrasse 86
Fax:+41 61 383 14 67 4053 Basel
Web:www.sygroup.ch tonnerre.lombard@xxxxxxxxxx
Attachment:
signature.asc
Description: PGP signature
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/