0

I thought this would be a good place to ask this question:

I want to open up my default SSH port (enable remote management in system settings and port forward my router) to see how many unauthorized access attempts I receive. Doing this as an experiment, I just wanted some advice before I do it.

In OSX, if I enable remote login but have no users in the "allowed access for: only these users", does this make my system impenetrable, no matter how hard someone tries to force (or bruteforce) their way in?

Are there any other precautions you would suggest I take?

Also, newly in OSX Mountain Lion, intrusion logs have been merged with the system.log file. When I look at it via console, it's all lost in a jumble of other irrelevant data that I have to sift through. Is there a way to only display the specific types of logs that I'm looking for?

3
  • 1
    Nothing is impenetrable. If you open a port, then whatever is listening on that port and its flaws are open to the world. If there are any known - or unknown - security flaws in that program then you are taking a risk. I would say the risk is minimal, but still there.
    – Keltari
    Aug 14, 2013 at 1:09
  • since SSH is SSH, wouldn't running a VM with a honey pot be more useful?
    – Journeyman Geek
    Aug 14, 2013 at 1:09
  • Just so you know, there are bots running all over the internet perpetually looking for ssh and running brute force attempts against them (poorly in my experience). There are probably stats available already without going to the trouble.
    – Paul
    Aug 14, 2013 at 3:45

3 Answers 3

2

In OSX, if I enable remote login but have no users in the "allowed access for: only these users", does this make my system impenetrable, no matter how hard someone tries to force (or bruteforce) their way in?

If "Allow access for" is set to "Only these users:" and the user list is empty, then no one will be able to log in using ssh.

Also, newly in OSX Mountain Lion, intrusion logs have been merged with the system.log file. When I look at it via console, it's all lost in a jumble of other irrelevant data that I have to sift through. Is there a way to only display the specific types of logs that I'm looking for?

The "Console" application allows you to view the system log and filter it based on arbitrary strings (the filter control is in the top right of the console window). So if you filter it on sshd, you'll only see messages from (or mentioning) sshd.

1
  • Ok great, thanks for the info. I was filtering by sshd, just wanted to make sure I wasn't missing any other relevant logs.
    – user
    Aug 14, 2013 at 1:10
1

What you want to setup is a honeypot, see http://en.wikipedia.org/wiki/Honeypot_(computing). I wouldn't do it with the real SSH daemon

0

If I was going to do this, I'd consider buying a raspberry pi to do it, or at least using a VM or docker. And install Fail2ban first.

My experience with one cloud-hosted VM was that within minutes automated attacks came in on port 22, continuous day & night. That persuaded me to get to grips with fail2ban.

At home however, I haven't had that. Maybe my ISP is filtering it out?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .