4 ms·
The problem is that you are also at the mercy of passwords selected by your users for smtp, imap, etc. So you still need some defence against brute force. For
by cm2187 5y ago
The problem is that you are also at the mercy of passwords selected by your users for smtp, imap, etc. So you still need some defence against brute force.
For administrative protocols (ssh, rdp, etc), I am a firm believer in IP whitelists, which give you the additional peace of mine of protecting you against future zero days, unless they affect the firewall.
- fabian2k 5y agoFor SSH simply disallowing passwords entirely removes this problem. For me that's the one single thing that dramatically improves defense against any kind of brute force or untargeted attack.
- zinekeller 5y agoI'm actually shocked that you're the first one to mention it. Only use public key logins and if you're not targeted and if it's practical in your workflow change the port (definitely not for security, only so that sshd won't eat as much CPU time from bruteforce attempts).
- cube00 5y agoJust make sure you don't use a port any higher then 1024 or else a non root process can start up and take its place if the real one crashes.
- arc-in-space 5y agoOh, good to know, I will ignore this advice and excitedly await for this to happen to me
- Topolomancer 5y agoThat's an excellent point. I painted myself into a corner here because I am letting some of my friends use the server as well. Have to gently transition them to public key usage only now.
- bombcar 5y agoYou can restrict password auth to particular users/groups, which also greatly reduces the attack vector.
- Filligree 5y agoOr require OTP for password authentication.
- namibj 5y agoGive them a reasonable deadline, and just disable password login afterwards. This isn't something they should have trouble understanding/accepting.
- lima 5y agoNowadays, if you accept plain user-chosen passwords on SMTP or IMAP, you're already in trouble anyway. Often, the attacker doesn't even have to guess because your users likely re-used the same password across different services...