3 ms·
> A honeypot is designed to attract attackers, and is designed with bad security in mind. I wouldn't say that. You'd be very hard pressed to find a production
by nwh 13y ago
> A honeypot is designed to attract attackers, and is designed with bad security in mind.
I wouldn't say that. You'd be very hard pressed to find a production server without SSH, if not on the default port. I'm doing absolutely nothing to draw attention to myself, so it stands to reason that somebody who is (say, running a large website) would draw a lot more probes and "hacked" logins.
> amongst them not running SSH in the open
Moving SSH to a different port is the usual "fix" I see, which does next to nothing really. There's very little in terms of attacks against sshd, and none when you disable password based authentication. Having an open port is not an issue unto itself, unless you used an older Debian to generate your keys.
- acheron 13y agoMoving SSH to a different port does nothing if your system is being specifically targeted, but it stops 99% of drive-by bots. Not that they do much anyway but it at least stops them from showing up in your logs.
- nwh 13y agoJust out of interest I tried running on 22 and a very high random port, as you said significantly less, though not no attempts. I think it's a false sense of security more than anything.