Šodienas jautājumu un atbilžu sesija mums priecājas par SuperUser - Stack Exchange dalību, kas ir kopienas vadīta Q & A tīmekļa vietņu grupa.
Jautājums
SuperUser lasītājs Alfrēds M. vēlas zināt, vai viņš ir uz pareizā ceļa ar savienojuma drošību:
I have recently set up a small server with a low end computer running debian with the aim to use it as a personal git repository. I have enabled ssh and was quite surprised at the promptness at which it suffered from brute force attacks and the like. Then I read that this is quite common and learned about basic security measures to ward off these attacks (lots of questions and duplicates on serverfault deal with it, see for instance this one or this one).
But now I am wondering if all this is worth the effort. I decided to set up my own server mostly for fun: I could just rely on third party solutions such as those offered by gitbucket.org, bettercodes.org, etc. While part of the fun is about learning about Internet security, I have not enough time to dedicate to it to become an expert and be almost certain that I took the correct prevention measures.
In order to decide if I will continue to play with this toy project, I would like to know what I really risk in doing so. For instance, in what extent are the other computers connected to my network threaten as well? Some of these computer are used by people with even lesser knowledge than mine running Windows.
What is the probability that I get into real trouble if I follow basic guidelines such as strong password, disabled root access for ssh, non standard port for ssh and possibly disabling password login and using one of fail2ban, denyhosts or iptables rules?
Put another way, is there some big bad wolves I should fear or is it all mostly about shooing away script kiddies?
Vai Alfrēdam vajadzētu būt trešo pušu risinājumiem, vai arī viņa drošais risinājums ir drošs?
Atbilde
SuperUser autors TheFiddlerWins pārliecina Alfredu, ka tas ir diezgan drošs:
IMO SSH is one of the safest things to have listen on the open internet. If you’re really concerned have it listen on a non-standard high end port. I’d still have a (device level) firewall between your box and the actual Internet and just use port forwarding for SSH but that’s a precaution against other services. SSH itself is pretty damn solid.
I have had people hit my home SSH server occasionally (open to Time Warner Cable). Never had an actual impact.
Vēl viens ieguldītājs Stephane uzsver, cik viegli ir drošināt SSH:
Setting up a public key authentication system with SSH is really trivial and takes about 5 minutes to setup.
If you force all SSH connection to use it, then it’ll make your system pretty much as resilient as you can hope to without investing a LOT into security infrastructure. Frankly, it’s so simple and effective (as long as you don’t have 200 accounts – then it gets messy) that not using it should be a public offense.
Visbeidzot, Craig Watson piedāvā vēl vienu padomu, lai mazinātu ielaušanās mēģinājumus:
I also run a personal git server that’s open to the world on SSH, and I also have the same brute-force issues as you, so I can sympathise with your situation.
TheFiddlerWins has already addresses the main security implications of having SSH open on a publicly-accessible IP, but best tool IMO in response to brute-force attempts is Fail2Ban – software that monitors your authentication log files, detects intrusion attempts and adds firewall rules to the machine’s local
iptables
ugunsmūris. Jūs varat konfigurēt gan to, cik daudz mēģinājumu pirms aizlieguma, gan arī aizlieguma ilgumu (mans noklusējums ir 10 dienas).
Vai kaut ko pievienot paskaidrojumam? Skatieties komentāros. Vēlaties lasīt citas atbildes no citiem tehnoloģiju savvy Stack Exchange lietotājiem? Šeit skatiet pilnu diskusiju pavedienu.
