Security → Re: XOR.DDoS malware distributed via brute force SSH attacks

There's a feature of recent SSH that I have found really useful, especially at customer installations where we need to allow my access externally.

In /etc/ssh/sshd_config I set an option that allows connections from the local network to login as root and/or with a password, but from the outside, only an SSH key will work, and then only as a non-root user.

PermitRootLogin no
PasswordAuthentication no
 
Match Address 192.168.1.0/24,127.0.0.1,::1
  PermitRootLogin yes
  PasswordAuthentication yes
 

I use SSH keys almost exclusively, but there's simply no way I can get all my customers to, so this reduces the risk of outside exposure while still allowing convenient internal access.

Steve

Yes keys are a pain to manage, but it mitigates so many security problems.
Coupled with failtoban (easy to use iptables), sleeping at night becomes easy.
Thumbs up for the internal local network mini howto, I never thought of this.

That's pretty cool. I should do that on mine.