Re: [SLUG] Chinese intruder yesterday

[Erik de Castro Lopo <mle+slug@xxxxxxxxxxxxx>]

Jim Donovan wrote:

> I had port 22 open for a few hours yesterday but closed it when I
> noticed the following.

An open port 22 can be made safe. There are numerous articles available
on the net like the following:

    http://www.linuxjournal.com/article/8759
    http://www.debian-administration.org/articles/573

For the particular issue you had, probably the best option is to use
the AllowGroups option in sshd_config to restrict ssh access to users
of a specific group. On my machine I have

     AllowGroups sshlogin

and then add any specific users to that group.

Running SSH on a non standard port also helps.

Cheers,
Erik
-- 
----------------------------------------------------------------------
Erik de Castro Lopo
http://www.mega-nerd.com/