Tony Arnold wrote:
> [...]
> Having said, that Linux is not immune from the hackers. My experience is
> that most incidents with Linux machines have been down to week or
> default passwords. Hackers can then get in and use the machine to scan
> other machines for weaknesses. My guess is if you put a machine on the
> netork with an ssh daemon running and a user name of david and password
> of david (for example), then it will be compromised within 24 hours or
> less. (I know someone who did exactly this).
Hello, Tony.
I second that: We got hit because a user with a dictionary name set a
password of 12345 ...
You can slow down 'brute-force' attacks using IP-tables with, for
example, "fail2ban", which is in the Ubuntu repo's. This 'bans' an IP
after a configurable number of failed login attempts.
However, it's not just SSH that you have to worry about: One of my
servers was recently caught sending 100,000 SPAM emails because it had
been compromised using a PHP exploit via port 80.
I've previously used "Nikto" to check web servers for vulnerabilities:
http://www.cirt.net/nikto2
I've used "nessus":
http://www.nessus.org/nessus/
In the good old days, "nessus" was GPL. Unfortunately, "nessus" is no
longer FLOSS and requires a paid for subscription for 'professional'
use. However, there is now a FLOSS fork of the previously GPL "nessus"
code called OpenVAS:
http://www.openvas.org/
I've been trying this out recently, and it looks very good!
Bye,
Tony.
--
Dr. A.J.Travis, University of Aberdeen, Rowett Institute of Nutrition
and Health, Greenburn Road, Bucksburn, Aberdeen AB21 9SB, Scotland, UK
tel +44(0)1224 712751, fax +44(0)1224 716687, http://www.rowett.ac.uk
mailto:a.tra...@abdn.ac.uk, http://bioinformatics.rri.sari.ac.uk/~ajt
--
ubuntu-uk@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-uk
https://wiki.ubuntu.com/UKTeam/
