[121893] in North American Network Operators' Group
Re: SSH brute force China and Linux: best practices
daemon@ATHENA.MIT.EDU (Joe Greco)
Sat Jan 30 15:52:19 2010
From: Joe Greco <jgreco@ns.sol.net>
To: randy@psg.com (Randy Bush)
Date: Sat, 30 Jan 2010 14:51:46 -0600 (CST)
In-Reply-To: <m2sk9nnyi0.wl%randy@psg.com> from "Randy Bush" at Jan 30,
2010 03:12:07 PM
Cc: nanog@nanog.org
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
> > also enforce either strong passwords or require no passwords (e.g. keys
> > only) and everything should be cool.
>
> what is 'password'?
"password" is that thing that you use when you don't want one compromised
"passphrase for your DSA key" to give access to every resource under the
sun that you have access to.
Keys are fantastic when used to access a resource with relatively
permissive (or no) IP-based access lists, automated applications, etc.
However, where I have a resource that's already heavily restricted for
SSH by ACL, I sometimes prefer an actual password that has to be dredged
out of memory.
... JG
--
Joe Greco - sol.net Network Services - Milwaukee, WI - http://www.sol.net
"We call it the 'one bite at the apple' rule. Give me one chance [and] then I
won't contact you again." - Direct Marketing Ass'n position on e-mail spam(CNN)
With 24 million small businesses in the US alone, that's way too many apples.
