Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Presuming that nobody can steal the actual password from me myself, is it practically 99.9% impossible to use SSH to crack into my server running SSH on a standard port using very strong (24 symbols containing uppercase, lowercase numbers, parentheses, underscores, dollars, periods, etc. and no human language words) password?

share|improve this question
2  
I wouldn't post this as an answer because a lot of people seem to disagree with me for some reason, but changing the port to something non-standard will also help to decrease the attack surface. You'll obviously need to use the strong password and keep the server up to date to provide real security, but this will help avoid the common scans for open ports. –  Paul Kroon Jul 9 '10 at 2:12

5 Answers 5

up vote 3 down vote accepted

although rare, there are still 0-day exploits... so you never know. maybe you can limit access to port 22 [on firewall level] just to few hosts/networks?

or maybe you can go security-though-obscurity way and implement port knocking?

share|improve this answer
1  
I think port knocking is the best idea then. Limiting networks/hosts is a scaffold, I am very mobile and tend to use different wifi and 3G networks. –  Ivan Jul 8 '10 at 23:07

(still not enough reputation to comment which would have been preferred) Remember that YOUR password may be very strong while other users may possibly have really weak passwords. Put AllowGroups or AllowUsers into /etc/ssh/sshd_config to switch off ssh access for other users.

Also remember that your password may be too safe: This password will almost certainly get written down.

Having said that I think you're pretty safe; if you combine with port knocking or so you are very safe.

share|improve this answer
1  
+1 for AllowUsers...definitely a plus. –  Paul Kroon Jul 9 '10 at 2:09
1  
And for good measure add fail2ban –  tegbains Aug 28 '10 at 2:38

It all depends on how fast an attacker can hammer on your tcp/22 port for logins. If you're not using something to terminate such repeated connections, in time any password can be discovered. In this case, time will be a very long time. Months of constant hammering. In the SSH logs I've taken a stroll through I've seen little directed hammering against specific accounts, and lots of door knocking looking for weak passwords.

However, you can't assume all attackers are casual. Someone targeting you specifically will have the investment to wait several months to break in. It's for reasons like this that shared-key is preferred where possible. The password you describe is very likely to be three-nines impossible to crack (in reasonable time constraints). I wouldn't hold my breath for five-nines.

share|improve this answer
1  
"It all depends on how fast an attacker can hammer on your tcp/22 port for logins. If you're not using something to terminate such repeated connections" - Isn't it set up in all common distros by default nowadays? –  Ivan Jul 8 '10 at 23:10
2  
@Ivan Disappointingly, no, it's not. apt-get install denyhosts (debian based) pkg_add -r denyhosts (FreeBSD) is one of the first things to do on a fresh box. –  Pete Jul 8 '10 at 23:27
2  
Not always. Ubuntu doesn't have it by default and neither does openSUSE or Fedora/Centos. Pre-built packages exist for all three, but you have to take positive action to turn it on. –  sysadmin1138 Jul 8 '10 at 23:27
    
Thanks a lot - a really must-know while inobvious info. –  Ivan Jul 9 '10 at 0:12

Use denyhosts. Also consider using key based login rather than a passwrod.

share|improve this answer
    
Yes, I do use a key (and with a good random-symbolic passphrase, written down only in my mind and with an expiration date that makes sense). But there is still a password for the user which I've set the way I described. –  Ivan Jul 9 '10 at 0:10

Moving sshd to a non-standard port would probably be trivial to add to your configuration, and it would probably eliminate 99% of the ssh bot traffic. Why expose yourself to all the brute force attacks when you can hide so easily. ;-)

I also usually recommend configuring sshd to use only SSH key pair based authentication, if it is going to be exposed to the Internet at large. As long as you keep your private key secure, it is almost impossible for the bad guys to authenticate as you with the server.

As another commentator already pointed out, this does not protect you against 0 day exploits in sshd itself. It is always a good idea to limit the traffic to just the machines that need to connect via firewall rules.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.