Brute-Force SSH Server Attacks Surge (InformationWeek)

Fedora installs SSH and opens a hole for it in the default firewall. So far as I know this is
still true in Fedora 9.

This is a frustrating type of vulnerability because it involves the user doing something
stupid (using a really easy password for 'root' or having a really obvious username AND using
a really easy password). The phrase "brute-force" in the write-up really over-states what
they're trying, SSH isn't vulnerable to being brute-forced, each connection incurs a small but
deliberate delay which, combined with the deliberately slow PAM authentication step means that
attackers can't hope to try more than a thousand or so passwords in an hour.

As a brute force technique that would be hopeless. Even with the ability to connect to say 100
machines at a time (much more and you run into problems with port re-use that screw you up)
they couldn't make much headway. Instead they're relying on small dictionaries, of variable
quality. Some might have 500 very common passwords and try them all against the 'root'
account, others have username + password pairs, or try just a few usernames of old Unix
daemons and other system accounts (the latter attack certainly won't work on any vaguely
modern Linux distro since these accounts have no login privileges).

Unfortunately, we can't actually rely on users not to pick 'password' as the root password of
their machine. So we need to create a situation where ordinary users (since they're the only
ones who'll benefit) can switch off remote password authentication and disable login to the
root account.

It seems like Ubuntu and similar distros have decided instead to throw their hands in the air
and disable remote administation out of the box. In reality I'd guess that a large number of
machines get the remote auth turned back on (with appropriate holes in the firewall) when the
user realises how inconvenient this is. So it doesn't achieve our goal of making the user
safer (though it does mean Ubuntu supporters can say Ubuntu isn't vulnerable to this problem,
which gets them some cheerleading points)

I'd suggest that we need

• User friendly SSH key sharing. People who can play Solitaire and write a document in
OpenOffice.org also need to be able to create and use SSH keys to authenticate between their
laptop and desktop computer, between the desktop computer and the Linux storage/ AV server
under the stairs maintained by their spouse/ sibling/ neighbor and so on. This isn't so that
they can get a bash prompt but so that they can use SFTP and similar user authenticated remote
services.

• Documentation which concentrates on the "login as yourself, obtain root privileges only when
necessary" model, maybe through sudo and the existing privilege escalation dialogs in GUI
environments. We're 90% of the way there on this, and as a result should turn off root logins
altogether by default. If you can't log in as root, then attackers can't either.

But to some extent I think we have to "suck it up" on these unwanted log messages. Attackers
are trying to break into your machine, and being reminded of that is no bad thing.