Re: Compromised Linux box stories (Re: [SLUG] upgrading complicated installs

[Jan Schmidt <thaytan@xxxxxxxxxxxx>]

On Tue, 2008-06-03 at 10:21 +0800, jam wrote:
> On Tuesday 03 June 2008 08:50:26 slug-request@xxxxxxxxxxx wrote:
> > [...]
> >
> > > The server had ssh access enabled via password entry and fell victim
> > > to a brute force password attack.  

> 
> First thanks to everyone who contributed to this interesting thread :-)
> 
> Some (and this is critique :-) not criticism) had credible offers eg Mary and 
> turning sendmail into an open relay, but many just had a BadThing happen.
> 
> Daniel talks about 'brute forcing' a password:
> say [A-Za-z0-9!@#$%^&*()_/?] and 6 chars passwords
> 
> 6**70 umm 70 * log (2) and 10**8 brute forces / sec

I think you mean the much more sedate number of 70^6 combinations. At
10^8 tests per sec, that's a much scarier (70^6)/(10^8) = 1176.5 secs,
or under 20 mins to check the entire password space.

Fortunately, external brute-force testing of passwords doesn't typically
run to anything like that many tests per second!

J.
-- 
Jan Schmidt <thaytan@xxxxxxxxxxxx>