| View previous topic :: View next topic |
| Author |
Message |
krunk
Guru
Joined: 27 Jul 2003
Posts: 316
|
 Posted: Sun Sep 05, 2004 4:14 pm Post subject: Extra login attemps allowed...how to I stop? |
 |
|
I have set the max login retrys to 3 in my /etc/login.defs, however when someone attempts to login via ssh, they get 3 failures with no verbose output (as expected), but than they get an additional 3 attempts with a verbose prompt like this---> | Code: | | krunk@<my_ip>'s password: |
where are these other 3 coming from? Being that this reveals that there is, in fact, a user by that name at my ip I'd prefer to preveent this.
_________________
G4 1ghz iBook
PowerMac G3 (B&W) [Powered by Gentoo and Gentoo alone  ]
Dual G5
iPod 3rd generation |
|
| Back to top |
|
 |
krunk
Guru
Joined: 27 Jul 2003
Posts: 316
|
| Posted: Sun Sep 05, 2004 6:29 pm Post subject: |
|
|
I solved it by using public keys w/ no password authentication.
First you add this to your /etc/ssh/sshd_config:
| Code: |
PasswordAuthentication no
|
Than if you use PAM with sshd (like I do, with the UsePAM yes option in sshd_config), you modify the /etc/pam.d/sshd llike so:
| Code: |
#%PAM-1.0
# modified to only accept publickeys
#auth required pam_stack.so service=system-auth
#auth required pam_shells.so
#auth required pam_nologin.so
auth required /lib/security/pam_deny.so
auth required /lib/security/pam_warn.so
auth required /lib/security/pam_deny.so
account required pam_stack.so service=system-auth
password required pam_stack.so service=system-auth
session required pam_stack.so service=system-auth
|
The above also enables logging for failed authentication attempts as well.
If you don't know how to do public keys with ssh, this is a good guide:
http://www.sshkeychain.org/mirrors/SSH-with-Keys-HOWTO/SSH-with-Keys-HOWTO-4.html
_________________
G4 1ghz iBook
PowerMac G3 (B&W) [Powered by Gentoo and Gentoo alone ]
Dual G5
iPod 3rd generation |
|
| Back to top |
|
|
TheGandalfMite
n00b
Joined: 09 Sep 2003
Posts: 21
|
| Posted: Sun Sep 12, 2004 6:56 am Post subject: |
|
|
Hey all,
I'd just like to point out that the three extra password attempts do not, in fact, mean there's a valid account -- just ssh randomlongusername@host and you'll see what I mean 
TheGandalfMite |
|
| Back to top |
|
|
|
Networking & Security
