If possible, use the AllowUsers directive in sshd_config to limit access to specific users, and/or the hosts.allow/deny files to permit certain users from specific network ranges or not at all from other ranges, etc; ssh is tcp_wrapper friendly). Of course the firewall is your friend also (but should not be relied upon as the sole layer of protection).

If a system needs to be publicly accessible (i.e, you can limit access to a given network range), install and configure denyhosts. In fact there's no reason not to install and use it IMO (take yourself off te low hanging branches of the fruit tree). Then sit back and watch your hosts.deny file and denyhost report email folder grow and grow...

A minimum amount of due diligence will prevent so many cases of heartburn and stress.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/11518/35097#35097