[oclug] dictionary attacks

[Adrian Irving-Beer]

On Fri, Sep 02, 2005 at 08:04:02AM -0400, Phil Orpen wrote:

> Just noticed the first event of a brute force dictionary attack on
> ftp this time.  Seen it happening for over a year on ssh...  Just
> suggesting that whatever solution works for you on ssh be applied to
> ftp as well.

Like forcing your users to use non-dictionary passwords?

I assume you're talking about dictionary attacks against the
passwords.  SSH, of course, has the convenient option of disabling
password authentication altogether and forcing key-based
authentication, which I strongly encourage for any system.

Personally, I recommend against plain FTP in general, except in the
anonymous sense (where authentication is moot).  Having neither
encryption nor key-based authentication, it's not particularly secure
in any sense.

Chrooted access offers some protection against the rest of the system,
but should be on a partition mounted noexec, and the data stored there
had better not be important or have consequences if changed.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url : http://tux.oclug.on.ca/pipermail/oclug/attachments/20050902/bcb93086/attachment.pgp