3 ms·
I don't understand why people don't do this it is so much harder if not impossible for people to break into your server by normal means especially when you add
by buugs 17y ago
I don't understand why people don't do this it is so much harder if not impossible for people to break into your server by normal means especially when you add MaxAuthTries 3
- jrockway 17y agoI am pretty sure that 0-day remote exploits don't respect MaxAuthTries.
- lanaer 17y agoSo long as the exploit doesn’t require multiple login attempts at all (which I assume it wouldn’t) yeah. MaxAuthTries protects against other things.
- sho 17y agoMaxAuthTries only logs errors, right? That by itself is not enough. You'd want fail2ban or bansshee or something, which tail those log files and blackhole any IP that causes an auth/username failure too many times in a certain period. However, that wouldn't work in this case anyway because if there's a working exploit in sshd then an auth/username failure would never even be logged. It'd be straight in first try.
- weaksauce 17y agoThe default setting is 6. You are not throttling the attack too much by setting this to 3. I would set it to 0 so if you make one bad attempt you are out. This still does not solve the problem but it is a smallish roadblock. I would also set MaxStartups to 1 if you are the only person to login. This limits the number of unauthenticated people trying to concurrently log in.