The thing we've done here is deny all "interactive" login in sshd.
(PasswordAuthentication no in sshd_config). All users who need to login
carry a usb key with a password-protected private-key to login into the
servers...
While for most of the time we login from our office (fixed ip), then a
second ssh deamon listens on a non-standard port taht is only allowed trough
firewall from our office.
Nicolas
Hi,
I am running a Mac OS X Tiger Server and I am increasingly observing
attacks trying to log in via SSH and guessing user ids and passwords. The
server is only accessible via SSH from the Internet and only two user ids
whose passwords are well chosen can log in via SSH. Nevertheless, I would
like to limit those attacks since they also consume quite some resources,
esp. bandwidth. What are you practicing or suggesting? I am using the
firewall which is included with Mac OS X.
