Tag Info

Hot answers tagged

10

SSH brute force on root passwords that are not really, really easy (e.g. "god" ;)) will probably never succeed. However there are so many people trying it, I guess there are enough people using weak enough password that it makes sense for attackers to try. So yes, if you're using strong passwords you are probably safe, however there are several things you ...


8

On Unix systems PAM, or Pluggable Authentication Module is a nice administrative tool that comes with a crack library that you can test passwords against. After doing some recent security work, I know that Government standards usually have these guidelines when it comes to a password: Minimum Length of 14 characters At least 2 special characters At least ...


6

Bruce Schneier has a nice article on it, based on what a company has have to be common practice in people choice of passwords. EDIT: Oh, to generate password. You can use tools such as KeePass or Password Safe to auto generate and store different good password for your logins. See this question for more information.


6

The problem with a port open and exposed to the internet is that there is a program listening for messages on that port. If the messages that arrive are malformed (by the rules of the program doing the listening), then it should reject the request and close the port. However, if the program doing the listening has any vulnerabilities, then the attacker can ...


5

Personally what I try to do for passwords is first think of a relatively long memorable phrase and perform the following transformation on it: Include all unambiguous punctuation and the first letter of each word Perform German-style capitalisation (first word and all nouns / names as capitals), or the inverse... Replace some words or letters with digits, ...


5

grc.com has a nice page where you can get strong passwords.


4

I install DenyHosts on any machines with internet-facing ssh servers. It automatically adds the source IPs of repeatedly failing logins to hosts.deny.


3

The suggestions in the other answers on protecting yourself further when using SSH are very sensible. But specifically to your question, brute force attacks from a single user are unlikely to be effective except against common username/password combinations or dictionary words. A random alphanumeric 9 letter password strength is going to take around 6 ...


3

This is a great way to see how secure it is: http://www.passwordmeter.com/ This will tell you (around about) how much it would take for someone to bruteforce it: http://lastbit.com/pswcalc.asp


3

When security is a major factor, I always include some high ASCII characters. For example, 154 is Ü. Not only do these characters greatly increase the amount of time required for a brute force attack, but most attacks don't even scan that character range and are sometimes not even capable of it. Also, the obvious: Longer is more secure. Mix lower and ...


3

Generating a hash of any kind could be thought of as a form of "Lossy Compression", during the creation of the output you loose data about the input. The only way to get that data back is by "guessing" and trying the lossy operation again to see if you get the same result again. This is exactly what "Brute Forcing" is, guessing every possible value that ...


2

According to the Order of Windows Firewall with Advanced Security Rules Evaluation article: Block rules. This type of rule explicitly blocks a particular type of incoming or outgoing traffic. Because these rules are evaluated before allow rules, they take precedence. Network traffic that matches both an active block and an active allow rule is blocked.


2

Well, by definition, a brute force attack would mean to try out all possible passwords. You have unlimited tries, so that's a great start. Only numbers (0-9) are allowed, and a fixed length of 4 characters? That's excellent. Now you only need 10,000 tries. While this is an extremely easy password, it is unfortunately on an old device, so you could not ...


2

I've done some further analysis, and I believe I have determined that brute force attacking the recovery password would not be a good use of anyone's time....that is assuming my math is correct. The recovery password is created starting with a 128-bit key, split into 8 groups of 16 bits of entropy, written as a value between 0 and 65,535 (2^16 - 1). Each ...


2

The numbers are astronomically high. We can't predict with 100% accuracy how powerful computers will be in the future, but at least for now, cracking such a password would be a complete waste of time. A more useful consideration would be protection against things like cold boot attacks, which most encryption softwares have protected against, but BitLocker ...


2

Fail2Ban is great for automatically banning hosts that make multiple failed attempts to access some service with the use of iptables. Even if you do end up banning yourself somehow you can still get a new IP (a phone with an ssh client will work fine) and un-ban yourself. Guides found via a search engine like Google should help you set it up quickly. As ...


2

I found the answer in Juniper facebook page. These setting are for SSH and Telnet. And they don't work in http. Just this!


2

If you want to extensively test your application, you should take a look at a Linux distro called Kali. It has all the tools required for pentest and application attacks. A tool that is provided and could help you is Hydra. You can get it here: https://www.offensive-security.com/


2

brew info hydra shows: hydra: stable 8.1 (bottled), HEAD https://www.thc.org/thc-hydra/ Not installed From: https://github.com/Homebrew/homebrew/blob/master/Library/Formula/hydra.rb ==> Dependencies Build: pkg-config ✔ Required: openssl ✔ Optional: subversion ✘, libidn ✘, libssh ✘, pcre ✔, gtk+ ✔ ==> Options --with-gtk+ Build with gtk+ support ...


2

There is a bit more you can do with BlockSSHd. BlockSSHD is a Perl script based on BruteForceBlocker v1.2.3 that dynamically adds IPTables rules for Linux and pf firewall rules for BSD that block SSH brute force attacks. It can also detect ProFTPd login failures. It is quite neat and flexible. The BlockSSHD script can unblock IP address after a ...


2

The discussion at Diceware is an interesting read. For creating high value passwords and passphrases, the technique of a dictionary like diceware's and a good randomizer such as a handful of dice is a pretty good choice. Personally, I use PasswordSafe locked by a strong passphrase generated by the diceware technique. I let PasswordSafe generate every ...


1

As far as strength against brute force cracking goes, the best thing to do is increase the length and the number of possible combinations increase exponentially (literally). Of course, it's still a good idea to introduce some random characters and symbols to make dictionary attacks more difficult. Or maybe use a couple of words from different languages - ...


1

The SecurityStats site has a page where you can try your password fu It gives you guidelines on better passwords too. Microsoft also has a similar Password checker page Another similar Password Meter Google support suggestions -- Choosing a password and security question However, I have never liked the security question angle Good read on the Google ...


1

This site outlines the guidelines well, and will allow you to test it's security. I think coming up with your own will be more memorable then a generated one as well.


1

I solve this by adding another rule in syslog / rsyslog to pipe mail.* messages to a fifo in /etc/mail/mailban/syslog_fifo I then made a daemon to read syslog_fifo, parse the sendmail messages, and act on what is found. The history of each ip address and activity is tracked through a 1.5 million(!) row mysql table. Offending ip addresses are added to a ban ...


1

Well, given a 6-character long password with a-z, A-Z, 0-9 and special characters (for argument's sake, we'll use those found above the numbers on a qwerty keyboard) you're looking at 139,314,069,504 possible combinations. That's over 4,000 years to crack @ 1/sec. Even a 5-character letters and numbers only password is 916,132,832 combinations and ~29 years ...


1

CentOS has iptables. http://wiki.centos.org/HowTos/Network/IPTables 1.) You can configure CentOS to drop packets from anyone but a trusted (yours) ip address. 2.) You can configure ssh to listen to a non-standard port. Most attacks are coming from automated scripts on other compromised systems. Edit this in /etc/ssh/sshd_config 3.) You can set password ...


1

In standard hashing functions (e.g., UNIX passwords in /etc/shadow) the salt is stored as part of the hash. Pass the stored hash value as the salt and you should get the correct result. The hashed password value in /etc/shadow is actually a $ delimited record. For example, we have this hash of the password 'blarg': $1$KfcI/JTQ$b5VTf4i9Mnf6QFgLuVZNM0 ...


1

You are not wrong, you would need a proper GPU to accelerate hashcat. A popular choice as an alternative to hashcat is crunch http://sourceforge.net/projects/crunch-wordlist/files/crunch-wordlist/ For which google will give you a bevy of tutorials on the subject. I'm surprised you getting as high as 2000kps given the state of it. Generally speaking you want ...


1

While this is a little old and missed, you can restore the visitor IPs to your log by installing something like mod_cloudflare.



Only top voted, non community-wiki answers of a minimum length are eligible