Re: targetted SSH bruteforce attacks

[Bob Onformon <bob.onformon () gmail com>]

> Compare the work effort needed by an attacker to brute-force a password (I mean,
> c'mon Paul - these ssh woodpeckers wouldn't keep hammering if it didn't work
> once in a while) with how much woodpecking would be needed to brute-force
> a key-authenticated login.

It might be more secure if done properly, but that doesn't mean that
using password are insecure.
I bet that even with root-login enabled and using a strong password 8
characters or more, it's more likely that you die in traffic, than
that someone will brute-force your sshd.

Take a password consisting of 12 characters taken from 72 distinct
characters set. The attacker are able to test 100 password pr sec
against your server. He will still need 230000 years to test every
possible password.

There are more important things to worry about...

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/