http://enterprise.linux.com/article.pl?sid=07/03/26/1423232&amp;tid=129&amp;tid=100&amp;tid=35

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<HTML><HEAD><TITLE>Linux.com | Advanced SSH security tips and tricks</TITLE>

<META NAME="DESCRIPTION" CONTENT="Advanced SSH security tips and tricks -- article related to Security, System Administration, and Networking.">

<META NAME="TITLE" CONTENT="Advanced SSH security tips and tricks">
<META NAME="KEYWORDS" CONTENT="enterprise,The Enterprise Linux Resource,application development, business tools, Gnu, IBM, Linux, Linux download, Linux in business, Linux operating system, mobile computing, network security, Novell, open Source, php, Redhat, Slashdot, Suse, technology news, technology product reviews, technology tools, technology collaboration, technology information, Ximian, collaborative software, collaborative, development, collaboration tools, collaboration systems">
<link rel="SHORTCUT ICON" href="//www.linux.com/icon_lc.gif">

<link href="//www.linux.com/gen-styles-lc.css" rel="stylesheet" type="text/css">

<!-- start template: ID 205, header;misc;default -->

<LINK REL="top"       TITLE="The Enterprise Linux Resource" HREF="//www.linux.com/" >
<LINK REL="search"    TITLE="Search Linux.com" HREF="//enterprise.linux.com/search.pl">
<LINK REL="alternate" TITLE="Linux.com RSS" HREF="//enterprise.linux.com/enterprise.rss" TYPE="application/rss+xml">
<LINK REL="parent"    TITLE="Articles" HREF="//www.linux.com/">
<LINK REL="prev"      TITLE="Checking out the new Open Font Library" HREF="//enterprise.linux.com/article.pl?sid=07/03/22/169230">
<LINK REL="next"      TITLE="Free Geek Vancouver helps the needy get nerdy" HREF="//enterprise.linux.com/article.pl?sid=07/03/23/2042200">
<LINK REL="author"    HREF="//enterprise.linux.com/search.pl?op=stories&amp;author=175206">
<LINK REL="alternate" TITLE="Print Article" HREF="//enterprise.linux.com/print.pl?sid=07/03/26/1423232">
<style type="text/css">
li.more ul.showcases {width: 35em;left: -10em; font-size: 95%;}
.fancybox ul {list-style: none; margin: 0; padding: 0;}
.fancybox ul li {margin: .5em 0; padding: 0;}
</style>
<!-- DoubleClick Random Number -->
<script type="text/javascript">
   dfp_ord=Math.random()*10000000000000000;
   dfp_tile = 1;
</script>
<!-- End DoubleClick Random Number -->
<script type="text/javascript" src="//66.35.250.54/__utm.js"></script>
</HEAD>
<BODY BGCOLOR="#DDDDDD" TEXT="#222222" LINK="#000033" VLINK="#222222">
<!-- /article.pl --><!-- enterprise --> <!-- Enterprise --><!-- //enterprise.linux.com -->

<!-- add code. You can use your own ad system - we use one that 
sets a env variable in apache that contains the ad itself and just put it
in this block -->
<!-- end ad code -->

<!-- begin ostg navbar block -->
<h5 align="center" class="ostgnavbar"><a href="http://ostg.com" class="ostgnavbar"><font color="#334987">OSTG</font></a> <font color="#F78F1E">|</font> <a href="//www.linux.com/relocate.pl?id=ec738dbf59329d318604404517652b48" class="ostgnavbar">ThinkGeek</a> -&nbsp;<a href="//www.linux.com/relocate.pl?id=fc996afd59486cc9987b13717758c141" class="ostgnavbar">Slashdot</a> -&nbsp;<a href="//www.linux.com/relocate.pl?id=24e768a78bbc71286a1c999e25e5aef6" class="ostgnavbar">ITMJ</a> -&nbsp;<a href="//www.linux.com/relocate.pl?id=1a1265ea52b4c98bc626912eeed01bd7" class="ostgnavbar">NewsForge</a> -&nbsp;<a href="//www.linux.com/relocate.pl?id=dc81f2b9e11661f93adafa9a6224541c" class="ostgnavbar">SourceForge.net</a> -&nbsp;<a href="//www.linux.com/relocate.pl?id=9f3dcf67bd0b13bb309157f57a6773e9" class="ostgnavbar">freshmeat</a> -&nbsp;<a href="http://www.techsay.com/default.php?page=join.php&p=ostg&CID=LINUXCOM" class="ostgnavbar">Surveys</a> -&nbsp;<a href="//jobs.linux.com" class="ostgnavbar">Jobs</a> -&nbsp;<a href="//ostg.pricegrabber.com" class="ostgnavbar">PriceGrabber</a></h5>
<!-- end ostg navbar block -->
<div align="center"><small class="ostgnavbar">-advertisement-</small><br>

<!-- ad position 1 -->
<div id="fad1">
<!-- DoubleClick Ad Tag -->
<script type="text/javascript">
    document.write('<script type="text/javascript" src="http://ad.doubleclick.net/adj/ostg.linux/enterprise_p1_leader;pg=article;logged_in=0;tile='+dfp_tile+';tpc=tips;tpc=enterprise;tpc=security;tpc=networking;tpc=sysadmin;ord='+dfp_ord+'?"><\/script>');
    dfp_tile++;
</script>
</div>
<!-- End DoubleClick Ad Tag -->
</div>

<table width="30%" align="right"> 
	<tr> 
		<td height="75" valign="bottom" class="masthead_link">
<div class="mast_divide"><a href="http://linux.com/article.pl?sid=02/03/09/1727250" class="ostgnavbar"><b>New to Linux?</b></a></div>

<div class="mast_divide2" style="margin: 0 0 15px 0; padding-right: 10px;"><!-- ad position 8 -->
<div id="fad8">
<!-- DoubleClick Ad Tag -->
<script type="text/javascript">
    document.write('<script type="text/javascript" src="http://ad.doubleclick.net/adj/ostg.linux/enterprise_p8_spons;pg=article;logged_in=0;tile='+dfp_tile+';tpc=tips;tpc=enterprise;tpc=security;tpc=networking;tpc=sysadmin;ord='+dfp_ord+'?"><\/script>');
    dfp_tile++;
</script>
</div>
<!-- End DoubleClick Ad Tag --></div>
		</td>
	</tr> 
</table>
<br>

<div class="masthead"><a href="//www.linux.com"><img src="//66.35.250.54/xlc_logo.gif" alt="linux.com" border="0"></a></div>

<div class="mainnav_search">
	<form action="//enterprise.linux.com/search.pl" method="get" name="search">
		<input type="text" name="query" size="12" />
		&nbsp;
		<a href="javascript:document.search.submit();" title="Search">
			Search &raquo; 
		</a>
	</form>
</div>
<div class="mainnav">
	<ul>
		<li >
			<a href="//www.linux.com" title="Articles">
				Articles 
			</a>
		</li>
		<li >
			<a href="http://news.linux.com" title="News">
				News 
			</a>
		</li>
		<li >
			<a href="http://distrocenter.linux.com" title="Distributions">
				Distributions 
			</a>
		</li>
		<li >
			<a href="http://howtos.linux.com" title="HOWTOs">
				HOWTOs 
			</a>
		</li>
		<li>
			<a href="http://specialreports.linux.com" title="Special Reports">
				Special Reports
			</a>
		</li>
		<li id="showcase" onmouseover="this.className='more'" onmouseout="this.className='less'" class="less">
			<a href="http://showcase.linux.com" title="Sponsor Solutions">
				Sponsor Solutions 	
				
				<span style="vertical-align: text-top; color: #F58735; font-weight: bold; font-size: 80%;">
					New
				</span>
				
			</a>
			 
			<ul class="showcases">
				<li>
                                        <a href="http://showcase.linux.com/hpos.tmpl">
						&nbsp;&raquo;&nbsp;Open Source and Linux from HP
                                        </a>
                                </li>
				<li>
					<a href="http://showcase.linux.com/perforce.tmpl">
						&nbsp;&raquo;&nbsp;Perforce Fast Software Manager
					</a>
				</li>
			</ul>
			
		</li>
	</ul>
</div>
<div class="subnav" style="float: right;">
	<div class="user">
			
				<a href="//www.linux.com/login.pl" class="subnavl2">Log&nbsp;in</a>&nbsp;&raquo;&nbsp; 
				<a href="//www.linux.com/login.pl?op=newuserform" class="subnavl2">Create&nbsp;Account</a>&nbsp;&raquo;
			
	</div>
</div>
<div class="subnav">
	<a href="http://enterprise.linux.com/article.pl?sid=04/07/23/2219257" class="subnavl">Migration Guide</a> 
<a href="http://enterprise.linux.com/article.pl?sid=04/07/23/2247213" class="subnavl">Integration Guide</a> 
<a href="http://enterprise.linux.com/article.pl?sid=04/07/23/2226248" class="subnavl">Training and Certification Guide</a>
</div>



<br>

<table width="100%" cellpadding="0" cellspacing="0">
        <tr>
                <td width="100%" valign="top"><div class="content_top">
                                <div class="content_top3">
                                        <div class="content_top2"></div>
                                </div>
                        </div>
                        <div class="content"><div style="padding-right: 3em;">&nbsp;

<!-- end template: ID 205, header;misc;default -->



<!-- start template: ID 208, display;article;default -->

<!-- ad position 20 -->
<div id="fad20">
<!-- DoubleClick Ad Tag -->
<script type="text/javascript">
    document.write('<script type="text/javascript" src="http://ad.doubleclick.net/adj/ostg.linux/enterprise_p20_powerbar;pg=article;logged_in=0;tile='+dfp_tile+';tpc=tips;tpc=enterprise;tpc=security;tpc=networking;tpc=sysadmin;ord='+dfp_ord+'?"><\/script>');
    dfp_tile++;
</script>
</div>
<!-- End DoubleClick Ad Tag -->


<!-- start template: ID 150, dispStory;misc;default -->

<p class="story_topic"><A HREF="//enterprise.linux.com/search.pl?tid=129"><B>System Administration</B></A>     , <A HREF="//enterprise.linux.com/search.pl?tid=100"><B>Networking</B></A>   , <A HREF="//enterprise.linux.com/search.pl?tid=35"><B>Security</B></A>
</p> 
<table align="right"><tr><td nowrap><A HREF="//enterprise.linux.com/print.pl?sid=07/03/26/1423232"><IMG SRC="//66.35.250.54/print.gif" BORDER="0" ALT="Printer-friendly"></A> &nbsp;<A HREF="//enterprise.linux.com/email.pl?sid=07/03/26/1423232"><IMG SRC="//66.35.250.54/email.gif" BORDER="0" ALT="Email story"></A>&nbsp;<A HREF="#discuss"><IMG SRC="//66.35.250.54/discuss.gif" BORDER="0"></A></td></tr></table>

<h2 class="story_title"><b>Advanced SSH security tips and tricks</b></h2>

<p class="story_author">Friday March 30, 2007 <nobr>(08:01 AM GMT)</nobr></p>

<p class="story_author">By: <a href="mailto:%61%6e%7a%65%76%69%40%67%6d%61%69%6c%2e%63%6f%6d">An&#382;e Vidmar</a></p>

<p class="story_content">
In this article I'll show you some simple tricks to help you tighten security for your <a href="http://en.wikipedia.org/wiki/Ssh">secure shell</a> (SSH) service.





<p>
        
        <table cellpadding="10" cellspacing="0" align="right"><tr><td>
        <!-- ad position 6 -->
<div id="fad6">
<!-- DoubleClick Ad Tag -->
<script type="text/javascript">
    document.write('<script type="text/javascript" src="http://ad.doubleclick.net/adj/ostg.linux/enterprise_p6_imu;pg=article;logged_in=0;tile='+dfp_tile+';tpc=tips;tpc=enterprise;tpc=security;tpc=networking;tpc=sysadmin;ord='+dfp_ord+'?"><\/script>');
    dfp_tile++;
</script>
</div>
<!-- End DoubleClick Ad Tag -->
        </td></tr></table>
        <p>The SSH server configuration file is located in /etc/ssh/sshd_conf. You need to restart the SSH service after every change you make to that file in order for changes to take effect.</p>

<p> <strong>Change SSH listening port</strong> </p>

<p>By default, SSH listens for connections on port 22. Attackers use port scanner software to see whether hosts are running an SSH service. It's wise to change the SSH port to a number higher than 1024 because most port scanners (including <a href="http://insecure.org/nmap/index.html">nmap</a>) by default don't scan high ports.</p>

<p>Open the /etc/ssh/sshd_config file and look for the line that says:</p>

<p> <code>Port 22</code> </p>

<p>Change the port number and restart the SSH service:</p>

<p> <code>/etc/init.d/ssh restart</code> </p>

<p> <strong>Allow only SSH protocol 2</strong> </p>

<p>There are <a href="http://www.snailbook.com/faq/ssh-1-vs-2.auto.html">two versions</a> of the SSH protocol. Using SSH protocol 2 only is much more secure; SSH protocol 1 is subject to <a href="http://en.wikipedia.org/wiki/Ssh#Security_cautions">security issues</a> including <a href="http://en.wikipedia.org/wiki/Man_in_the_middle">man-in-the-middle</a> and <a href="http://www.securityspace.com/smysecure/catid.html?id=10268">insertion</a> attacks. Edit /etc/ssh/sshd_config and look for the line that says:</p>

<p> <code>Protocol 2,1</code> </p>

<p>Change the line so it says only <code>protocol 2</code>.</p>

<p> <strong>Allow only specific users to log in via SSH</strong> </p>

<p>You should not permit root logins via SSH, because this is a big and unnecessary security risk. If an attacker gains root login for your system,  he can do more damage than if he gains normal user login. Configure SSH server so that root user is not allowed to log in. Find the line that says:</p>

<p> <code>PermitRootLogin yes</code> </p>

<p>Change <code>yes</code> to <code>no</code> and restart the service. You can then log in with any other defined user and switch to user root if you want to become a superuser.</p>

<p>It is wise to create a dummy local user with absolutely no rights on the system and use that user to login into SSH. That way no harm can be done if the user account is compromised. When creating this user, make sure it's in the wheel group, so that you can switch to superuser. </p>

<p>If you would like to have a list of users who are the only ones able to log in via SSH, you can specify them in the sshd_config file. For example, let's say I want to allow users anze, dasa, and kimy to log in via SSH. At the end of sshd_config file I would add a line like this:</p>

<p> <code>AllowUsers anze dasa kimy</code> </p>

<p> <strong>Create a custom SSH banner</strong> </p>

<p>If you would like any user who connects to your SSH service to see a specific message, you can create a custom SSH banner. Simply create a text file (in my example in /etc/ssh-banner.txt) and put any kind of text message in it; for example:</p>

<p> <code>
*****************************************************************<br>
*This is a private SSH service. You are not supposed to be here.*<br>
*Please leave immediately.                                      *<br>
*****************************************************************</code> </p>

<p>When done editing, save the file. In the sshd_conf file, find a line that says:</p>

<p> <code>#Banner /etc/issue.net</code> </p>

<p>Uncomment the line and change the path to your custom SSH banner text file.</p>

<p> <strong>Using DSA public key authentication</strong> </p>

<p>Instead of using login names and passwords for SSH authentication, you can use DSA public keys for authentication. Note that you can have both login names and DSA public key authentication enabled at the same time. Having a DSA public keys authentication enabled makes your system bulletproof against dictionary attacks, because you don't need a login name and password to log in into SSH service. Instead, you need a pair of DSA keys -- one public and one private. You keep the private key on your machine and copy the public key to the server. When you want to log in to an SSH session, the server checks the keys, and if they match, you are dropped into the shell. If the keys don't match, you are disconnected.</p>

<p>In this example the private machine (from which I will connect to the server) is station1 and the server machine is server1. On both machines I have the same home folder; this won't work if the home folders are different on client and server machine. First you need to create a pair of keys on your private machine with the command <code>~$ ssh-keygen -t dsa</code>. You'll be prompted for a pass-phrase for your private key, but you can leave it blank because this is not a recommended method. A key pair is generated: your private key is located in ~/.ssh/id_dsa and your public key is located in .ssh/id_dsa.pub. </p>

<p>Next, copy the contents of ~/.ssh/id_dsa.pub to server1 into the ~/.ssh/authorized_keys file. The content of ~/.ssh/id_dsa.pub file should look something like this:</p>

<p> <code>~$ cat .ssh/id_dsa.pub<br>
ssh-dss AAAAB3NzaC1kc3MAAACBAM7K7vkK5C90RsvOhiHDUROvYbNgr7YEqtrdfFCUVwMWcJYDusNG<br>
AIC0oZkBWLnmDu+y6ZOjNPOTtPnpEX0kRoH79maX8NZbBD4aUV91lbG7z604ZTdrLZVSFhCI/Fm4yROH<br>
Ge0FO7FV4lGCUIlqa55+QP9Vvco7qyBdIpDuNV0LAAAAFQC/9ILjqII7nM7aKxIBPDrQwKNyPQAAAIEA<br>
q+OJC8+OYIOeXcW8qcB6LDIBXJV0UT0rrUtFVo1BN39cAWz5puFe7eplmr6t7Ljl7JdkfEA5De0k3WDs<br>
9/rD1tJ6UfqSRc2qPzbn0p0j89LPIjdMMSISQqaKO4m2fO2VJcgCWvsghIoD0AMRC7ngIe6btaNIhBbq<br>
ri10RGL5gh4AAACAJj1/rV7iktOYuVyqV3BAz3JHoaf+H/dUDtX+wuTuJpl+tfDf61rbWOqrARuHFRF0<br>
Tu/Rx4oOZzadLQovafqrDnU/No0Zge+WVXdd4ol1YmUlRkqp8vc20ws5mLVP34fST1amc0YNeBp28EQi<br>
0xPEFUD0IXzZtXtHVLziA1/NuzY= anze@station1.example.com</code> </p>

<p>If the file ~/.ssh/authorized_keys already exists, append the contents of the file ~/.ssh/id_dsa.pub to the file ~/.ssh/authorized_keys on server1. The only thing left to do is to set the correct permissions of ~/.ssh/authorized_keys file on server1:</p>

<p> <code>~$ chmod 600 ~/.ssh/authorized_keys</code> </p>

<p>Now, configure the sshd_conf file to use the DSA keys authentication. Make sure you have the following three lines uncommented:</p>

<p> <code>RSAAuthentication yes<br>
PubkeyAuthentication yes<br>
AuthorizedKeysFile %h/.ssh/authorized_keys</code> </p>

<p>Restart the service. If you configured everything correctly, you should now be able to SSH to your server and fall directly into your home folder without any interaction.</p>

<p>If you would like to use DSA authentication only, make sure you uncomment and change the <code>PasswordAuthentication</code> line in sshd_config from <code>yes</code> to <code>no</code>:</p>

<p> <code>PasswordAuthentication no</code> </p>

<p>If anyone tries to connect to your SSH service and doesn't have a public key on the server, he will be rejected without even seeing the login prompt with this error:</p>

<p> <code>Permission denied (publickey).</code> </p>

<p> <strong>Using TCP wrappers to allow only specific hosts to connect</strong> </p>

<p>This approach is useful if you would like to allow only specific hosts on a network to be able to connect to your SSH service, but you don't want to use or mess up your iptables configuration. Instead, you can use TCP wrappers; in this case the sshd TCP wrapper. I will make a rule to allow only hosts on my local subnet 192.168.1.0/24 and remote host 193.180.177.13 to connect to my SSH service.</p>

<p>By default TCP wrappers first look in the /etc/hosts.deny file to see what hosts are denied for what service. Next, TCP wrapper looks in /etc/hosts.allow file to see if there are any rules that would allow hosts to connect to a specific service. I'll create a rule like this in /etc/hosts.deny:</p>

<p> <code>sshd: ALL</code> </p>

<p>This means that by default all hosts are forbidden to access the SSH service. This needs to be here, otherwise all hosts would have access to the SSH service, since TCP wrappers first looks into hosts.deny file and if there is no rule regarding blocking SSH service, any host can connect. </p>

<p>Next, create a rule in /etc/hosts.allow to allow only specific hosts (as defined earlier) to use the SSH service:</p>

<p> <code>sshd: 192.168.1 193.180.177.13</code> </p>

<p>Now only hosts from the 192.168.1.0/24 network and the 193.180.177.13 host can access the SSH service. All other hosts are disconnected before they even get to the login prompt, and receive an error like this:</p>

<p> <code>ssh_exchange_identification: Connection closed by remote host</code> </p>

<p> <strong>Using iptables to allow only specific hosts to connect</strong> </p>

<p>An alternative to TCP wrappers (although you can use both at the same time) is limiting SSH access with iptables. Here's a simple example of how you can allow only a specific host to connect to your SSH service:</p>

<p> <code>~# iptables -A INPUT -p tcp -m state --state NEW --source 193.180.177.13 --dport 22 -j ACCEPT</code> </p>

<p>And make sure no one else has access to SSH service:</p>

<p> <code>~# iptables -A INPUT -p tcp --dport 22 -j DROP</code> </p>

<p>Save your new rules and you're all done.</p>

<p> <strong>SSH time-lock tricks</strong> </p>

<p>You can also use different iptables parameters to limit connections to the SSH service for specific time periods. You can use the /second, /minute, /hour, or /day switch in any of the following examples.</p>

<p>In the first example, if a user enters the wrong password, access to the SSH service is blocked for one minute, and the user gets only one login try per minute from that moment on:</p>

<p> <code>~# iptables -A INPUT -p tcp -m state --syn --state NEW --dport 22 -m limit --limit 1/minute --limit-burst 1 -j ACCEPT<br>
~# iptables -A INPUT -p tcp -m state --syn --state NEW --dport 22 -j DROP</code> </p>

<p>In a second example, iptables are set to allow only host 193.180.177.13 to connect to the SSH service. After three failed login tries, iptables allows the host only one login try per minute:</p>

<p> <code>~# iptables -A INPUT -p tcp -s 193.180.177.13 -m state --syn --state NEW --dport 22 -m limit --limit 1/minute --limit-burst 1 -j ACCEPT<br>
~# iptables -A INPUT -p tcp -s 193.180.177.13 -m state --syn --state NEW --dport 22 -j DROP</code> </p>

<p> <strong>Conclusion</strong> </p>

<p>These features are not hard to configure, but they are very powerful techniques for securing your SSH service. It's a small price to pay for a good night's sleep.</p>
</p>



<table cellpadding="2" cellspacing="1" bgcolor="#ffffff" style="border: 1px solid #dddddd;">





</table>
<p>
<!-- Start Slashdot This link -->
<p>
<a href="javascript:location.href='http://slashdot.org/bookmark.pl?url='+encodeURIComponent(location.href)+'&amp;title='+encodeURIComponent(document.title)"><img src="http://images.slashdot.org/favicon.ico" alt="Slashdot" border="0" height="16" width="16"></a>&nbsp;<a href="javascript:location.href='http://slashdot.org/bookmark.pl?url='+encodeURIComponent(location.href)+'&amp;title='+encodeURIComponent(document.title)" title="Submit this item to Slashdot.org">Slashdot it!</a>
</p>
<!-- End Slashdot This link -->

&nbsp;&nbsp;<A HREF="//enterprise.linux.com/print.pl?sid=07/03/26/1423232"><IMG SRC="//66.35.250.54/print.gif" BORDER="0" ALT="Printer-friendly"></A> &nbsp;&nbsp;<A HREF="//enterprise.linux.com/email.pl?sid=07/03/26/1423232"><IMG SRC="//66.35.250.54/email.gif" BORDER="0" ALT="Email story"></A>&nbsp;&nbsp;<A HREF="#discuss"><IMG SRC="//66.35.250.54/discuss.gif" BORDER="0"></A></p>

<!-- end template: ID 150, dispStory;misc;default -->


<p><br />&nbsp;</p><h3><b>Related Links</b></h3><div class="title_divide"></div>
&middot; <a href="http://insecure.org/nmap/index.html">nmap</a><br>
&middot; <a href="http://www.snailbook.com/faq/ssh-1-vs-2.auto.html">two versions</a><br>
&middot; <a href="http://en.wikipedia.org/wiki/Ssh#Security_cautions">security issues</a><br>
&middot; <a href="http://en.wikipedia.org/wiki/Man_in_the_middle">man-in-the-middle</a><br>
&middot; <a href="http://www.securityspace.com/smysecure/catid.html?id=10268">insertion</a><br>
&middot; <a href="http://en.wikipedia.org/wiki/Ssh">secure shell</a><br>
&middot; <B><A HREF="http://ostg.pricegrabber.com/mrdr.php?mode=ostg_linux_System_Administration&url=http%3A%2F%2Fostg.pricegrabber.com/search_gen_top.php/topcat_search=1/form_keyword=System%20Administration">Best deals: System Administration </A></B><BR>

&middot; <A HREF="//www.linux.com/search.pl?tid=129">More System Administration stories</A><BR>




&middot; <B><A HREF="http://ostg.pricegrabber.com/mrdr.php?mode=ostg_linux_Networking&url=http%3A%2F%2Fostg.pricegrabber.com/search_gen_top.php/topcat_search=1/form_keyword=Networking">Best deals: Networking </A></B><BR>

&middot; <A HREF="//www.linux.com/search.pl?tid=100">More Networking stories</A><BR>




&middot; <B><A HREF="http://ostg.pricegrabber.com/mrdr.php?mode=ostg_linux_Security&url=http%3A%2F%2Fostg.pricegrabber.com/search_gen_top.php/topcat_search=1/form_keyword=Security">Best deals: Security </A></B><BR>

&middot; <A HREF="//www.linux.com/search.pl?tid=35">More Security stories</A><BR>
<P align="center">
<font size="-1">



 <BR>&lt;&nbsp; <A HREF="//applications.linux.com/article.pl?sid=07/03/22/169230&amp;tid=13">Checking out the new Open Font Library</A>
  | <A HREF="//community.linux.com/article.pl?sid=07/03/23/2042200&amp;tid=19">Free Geek Vancouver helps the needy get nerdy</A> &nbsp;&gt; 




</font>
</p>

<!-- end template: ID 208, display;article;default -->



<!-- start template: ID 261, printCommentsMain;misc;default -->

<div style="padding-right: 3em">

<b>Comments</b> on <A HREF="//enterprise.linux.com/article.pl?sid=07/03/26/1423232&tid=129">Advanced SSH security tips and tricks</A><div class="title_divide"></div>




<!--	<A HREF="//enterprise.linux.com/article.pl?sid=07/03/26/1423232&tid=129"><FONT COLOR="#99ccff">Advanced SSH security tips and tricks</FONT></A> -->
                <A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;op=Reply&amp;threshold=0&amp;commentsort=0&amp;mode=thread&amp;tid=129&amp;tid=100&amp;tid=35&amp;pid=0">Post to discussion</A>


-	


		<A HREF="//enterprise.linux.com/users.pl">Log in/Create an Account</A> -  


		 <A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;op=&amp;threshold=0&amp;commentsort=0&amp;mode=thread&amp;tid=129&amp;tid=100&amp;tid=35&amp;pid=0">Return to top level</A>




		- <B>37</B> comments






		- <A HREF="//enterprise.linux.com/search.pl?op=comments&amp;sid=38274">Search Discussion</A>
<br>
		<FORM ACTION="//enterprise.linux.com/comments.pl">
		<INPUT TYPE="HIDDEN" NAME="sid" VALUE="38274">
		
		
		

		Display Options: 
		

<!-- start template: ID 241, select;misc;default -->

<SELECT NAME="threshold">
	<OPTION VALUE="0" SELECTED>0: 37 comments</OPTION>
	<OPTION VALUE="1">1: 37 comments</OPTION>
	<OPTION VALUE="2">2: 0 comments</OPTION>
</SELECT>

<!-- end template: ID 241, select;misc;default -->



<!-- start template: ID 241, select;misc;default -->

<SELECT NAME="mode">
	<OPTION VALUE="flat">Flat</OPTION>
	<OPTION VALUE="nested">Nested</OPTION>
	<OPTION VALUE="nocomment">No Comments</OPTION>
	<OPTION VALUE="thread" SELECTED>Threaded</OPTION>
</SELECT>

<!-- end template: ID 241, select;misc;default -->



<!-- start template: ID 241, select;misc;default -->

<SELECT NAME="commentsort">
	<OPTION VALUE="0" SELECTED>Oldest First</OPTION>
	<OPTION VALUE="1">Newest First</OPTION>
	<OPTION VALUE="3">Highest Scores First</OPTION>
	<OPTION VALUE="4">Oldest First (Ignore Threads)</OPTION>
	<OPTION VALUE="5">Newest First (Ignore Threads)</OPTION>
</SELECT>

<!-- end template: ID 241, select;misc;default -->



	

		<INPUT TYPE="submit" NAME="op" VALUE="Change">
		
			<INPUT TYPE="submit" NAME="op" VALUE="Reply">
		
		</FORM>
<h5><B>The Fine Print:</B>
The following comments are owned by whoever posted them.
We are not responsible for them in any way.
</h5>


</div>

<!-- end template: ID 261, printCommentsMain;misc;default -->



<!-- start template: ID 237, printCommComments;misc;default -->

<div style="padding-right: 3em">


<a name="discuss"></a>

        <FORM ACTION="//enterprise.linux.com/comments.pl" METHOD="POST">
        <INPUT TYPE="HIDDEN" NAME="sid" VALUE="38274">
        <INPUT TYPE="HIDDEN" NAME="cid" VALUE="0">
        <INPUT TYPE="HIDDEN" NAME="pid" VALUE="0">
<div style="padding-right: 3em">
<table cellpadding="0" cellspacing="0">

	        

<!-- begin dispComment -->


	<TR><TD>
				<FONT FACE="verdana,helvetica,arial" SIZE="+0"><A NAME="97784"></a><B>A few mistakes</B>  <font size="-1">(Neutral)</font>
</FONT>
<div style="padding-left: .4em; margin-top: 0px; border-top: 2px #eeeeee solid;">
<FONT FACE="verdana,helvetica,arial" SIZE="1">By
<A HREF="//www.linux.com/~hawhill">hawhill (216893)</A>

&lt;<A HREF="mailto:hilse%40web.de">hilse@web.de</A>&gt;
on 2007.03.30  5:15
 (<A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;cid=97784">#97784</A>)</FONT>



</div>
<div style="padding: .4em; border-top: 1px #dddddd solid; border-bottom: 3px #cccccc solid;">

<font size="-1">- What you call DSA authentication isn't dependent on DSA, and is usuallly referred to as "Public Key Authentication". It works with RSA, too. By default, ssh-keygen even will generate RSA keys.

- "RSAAuthentication yes" is not needed for a Protocol 2 only server, since it's a Protocol 1 setting.

- Firewalling your SSHd like in the mentioned iptables settings will open a huge hole for DOS attacks.

	<BR>



</font>

</div>

	</TD></TR>

<!-- begin of dispLinkComment -->
<TR><TD><FONT SIZE="-1">


	
		
		 
		[ 
			
		
			
		<A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;op=Reply&amp;threshold=0&amp;commentsort=0&amp;mode=thread&amp;tid=129&amp;tid=100&amp;tid=35&amp;pid=97784">Reply to This</A>
			
		

		
			
		
			
		


		
		
		

		

		

		


	
		
 ]
</font>
<!-- end of dispLinkComment -->

<!-- end dispComment --><TR><TD><UL></UL></TD></TR><!-- begin dispComment -->


	<TR><TD>
				<FONT FACE="verdana,helvetica,arial" SIZE="+0"><A NAME="97789"></a><B>Root</B>  <font size="-1">(Neutral)</font>
</FONT>
<div style="padding-left: .4em; margin-top: 0px; border-top: 2px #eeeeee solid;">
<FONT FACE="verdana,helvetica,arial" SIZE="1">By
Anonymous Reader


on 2007.03.30  6:07
 (<A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;cid=97789">#97789</A>)</FONT>



</div>
<div style="padding: .4em; border-top: 1px #dddddd solid; border-bottom: 3px #cccccc solid;">

<font size="-1">Another interesting option is to set the "PermitRootLogin" to "without-password" instead of "no", so the root user can log in, but only using a DSA or RSA key (passwords are not allowed with this option)...

	<BR>



</font>

</div>

	</TD></TR>

<!-- begin of dispLinkComment -->
<TR><TD><FONT SIZE="-1">


	
		
		 
		[ 
			
		
			
		<A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;op=Reply&amp;threshold=0&amp;commentsort=0&amp;mode=thread&amp;tid=129&amp;tid=100&amp;tid=35&amp;pid=97789">Reply to This</A>
			
		

		
			
		
			
		


		
		
		

		

		

		


	
		
 ]
</font>
<!-- end of dispLinkComment -->

<!-- end dispComment --><TR><TD><UL></UL></TD></TR><!-- begin dispComment -->


	<TR><TD>
				<FONT FACE="verdana,helvetica,arial" SIZE="+0"><A NAME="97791"></a><B>'Advanced' tips and tricks</B>  <font size="-1">(Neutral)</font>
</FONT>
<div style="padding-left: .4em; margin-top: 0px; border-top: 2px #eeeeee solid;">
<FONT FACE="verdana,helvetica,arial" SIZE="1">By
Anonymous Reader


on 2007.03.30  6:28
 (<A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;cid=97791">#97791</A>)</FONT>



</div>
<div style="padding: .4em; border-top: 1px #dddddd solid; border-bottom: 3px #cccccc solid;">

<font size="-1">I agree with all what hawhill wrote, but these aren't 'advanced' tips. They're pretty standard ones, simply other than 'default'. I strongly disagree on the root login. You shouldn't allow remote root logins at all.  I barely login as root even on my local machine. The only two reasons to allow root to login are: only root account exists or there's no su/sudo; both are bad ideas.<br><br>What about the 'tricks'? Haven't seen any. Does anyone actually check the articles before they're published? If you wan't to write an article on advanced features of SSH write about using it with kerberos or keys on smartcards, and when you're refering to 'tricks' write about something that cannot be found on every second article about SSH or in the manual page itself.<br><br>Regards,

	<BR>



</font>

</div>

	</TD></TR>

<!-- begin of dispLinkComment -->
<TR><TD><FONT SIZE="-1">


	
		
		 
		[ 
			
		
			
		<A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;op=Reply&amp;threshold=0&amp;commentsort=0&amp;mode=thread&amp;tid=129&amp;tid=100&amp;tid=35&amp;pid=97791">Reply to This</A>
			
		

		
			
		
			
		


		
		
		

		

		

		


	
		
 ]
</font>
<!-- end of dispLinkComment -->

<!-- end dispComment --><TR><TD><UL><LI><A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;op=&amp;threshold=0&amp;commentsort=0&amp;mode=thread&amp;tid=129&amp;tid=100&amp;tid=35&amp;pid=97791#97796">Re:'Advanced' tips and tricks</A>




	
	
	by Anonymous Reader
	



 <FONT SIZE="-1">(Neutral)</FONT>


	<FONT SIZE="-1">2007.03.30  7:09</FONT><UL></UL></LI></UL></TD></TR><!-- begin dispComment -->


	<TR><TD>
				<FONT FACE="verdana,helvetica,arial" SIZE="+0"><A NAME="97792"></a><B>I would have though hide it.</B>  <font size="-1">(Neutral)</font>
</FONT>
<div style="padding-left: .4em; margin-top: 0px; border-top: 2px #eeeeee solid;">
<FONT FACE="verdana,helvetica,arial" SIZE="1">By
Anonymous Reader


on 2007.03.30  6:39
 (<A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;cid=97792">#97792</A>)</FONT>



</div>
<div style="padding: .4em; border-top: 1px #dddddd solid; border-bottom: 3px #cccccc solid;">

<font size="-1">Port knocking most effective way I know of.<br><br>If scanner does not see it cracker does not know there is a ssh service.  So how can cracker attack it if its not there in there eyes.<br><br>nmap can be ordered to scan all ports and can attempt to id service by response.  So hiding high is not that effective.

	<BR>



</font>

</div>

	</TD></TR>

<!-- begin of dispLinkComment -->
<TR><TD><FONT SIZE="-1">


	
		
		 
		[ 
			
		
			
		<A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;op=Reply&amp;threshold=0&amp;commentsort=0&amp;mode=thread&amp;tid=129&amp;tid=100&amp;tid=35&amp;pid=97792">Reply to This</A>
			
		

		
			
		
			
		


		
		
		

		

		

		


	
		
 ]
</font>
<!-- end of dispLinkComment -->

<!-- end dispComment --><TR><TD><UL></UL></TD></TR><!-- begin dispComment -->


	<TR><TD>
				<FONT FACE="verdana,helvetica,arial" SIZE="+0"><A NAME="97798"></a><B>a Mistake?</B>  <font size="-1">(Neutral)</font>
</FONT>
<div style="padding-left: .4em; margin-top: 0px; border-top: 2px #eeeeee solid;">
<FONT FACE="verdana,helvetica,arial" SIZE="1">By
Anonymous Reader


on 2007.03.30  7:16
 (<A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;cid=97798">#97798</A>)</FONT>



</div>
<div style="padding: .4em; border-top: 1px #dddddd solid; border-bottom: 3px #cccccc solid;">

<font size="-1"><blockquote><div>~# iptables -A INPUT -p tcp -m state --syn --state NEW --dport 22 -m limit --limit 1/minute --limit-burst 1 -j ACCEPT</div><div>
~# iptables -A INPUT -p tcp -m state --syn --state NEW --dport 22 -j DROP</div><p>

In a second example, iptables are set to allow only host 193.180.177.13 to connect to the SSH service. After three failed login tries, iptables allows the host only one login try per minute:</p><p>

~# iptables -A INPUT -p tcp -s 193.180.177.13 -m state --syn --state NEW --dport 22 -m limit --limit 1/minute --limit-burst 1 -j ACCEPT</p><div>
~# iptables -A INPUT -p tcp -s 193.180.177.13 -m state --syn --state NEW --dport 22 -j DROP</div></blockquote>

The only difference between two sets of iptable commands is source ip address filtering.
So for the second set of filters the behviour should be the same as for the first one for connenctions comming from specified ip address

	<BR>



</font>

</div>

	</TD></TR>

<!-- begin of dispLinkComment -->
<TR><TD><FONT SIZE="-1">


	
		
		 
		[ 
			
		
			
		<A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;op=Reply&amp;threshold=0&amp;commentsort=0&amp;mode=thread&amp;tid=129&amp;tid=100&amp;tid=35&amp;pid=97798">Reply to This</A>
			
		

		
			
		
			
		


		
		
		

		

		

		


	
		
 ]
</font>
<!-- end of dispLinkComment -->

<!-- end dispComment --><TR><TD><UL></UL></TD></TR><!-- begin dispComment -->


	<TR><TD>
				<FONT FACE="verdana,helvetica,arial" SIZE="+0"><A NAME="97799"></a><B>New security method</B>  <font size="-1">(Neutral)</font>
</FONT>
<div style="padding-left: .4em; margin-top: 0px; border-top: 2px #eeeeee solid;">
<FONT FACE="verdana,helvetica,arial" SIZE="1">By
Anonymous Reader


on 2007.03.30  7:22
 (<A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;cid=97799">#97799</A>)</FONT>



</div>
<div style="padding: .4em; border-top: 1px #dddddd solid; border-bottom: 3px #cccccc solid;">

<font size="-1">"Change SSH listening port"<br><br>Now there's a 'trick' for you. Top of the list.<br>Soooo bloody original, I can't believe it.<br><br>New security architecture: Houses with no front door. Entrance on side. Burglars totally fooled.<br><br>Rightttttttt!<br><br>The rest of the article is as useless as the first bit.<br><br>Perhaps there could be some kind of QA filter? Maybe run this kind of crap past the people who actually wrote ssh/sshd.<br><br>But what the hell would they know?<br>

	<BR>



</font>

</div>

	</TD></TR>

<!-- begin of dispLinkComment -->
<TR><TD><FONT SIZE="-1">


	
		
		 
		[ 
			
		
			
		<A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;op=Reply&amp;threshold=0&amp;commentsort=0&amp;mode=thread&amp;tid=129&amp;tid=100&amp;tid=35&amp;pid=97799">Reply to This</A>
			
		

		
			
		
			
		


		
		
		

		

		

		


	
		
 ]
</font>
<!-- end of dispLinkComment -->

<!-- end dispComment --><TR><TD><UL><LI><A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;op=&amp;threshold=0&amp;commentsort=0&amp;mode=thread&amp;tid=129&amp;tid=100&amp;tid=35&amp;pid=97799#97801">Re:New security method</A>




	
	
	by suso_banderas
	



 <FONT SIZE="-1">(Neutral)</FONT>


	<FONT SIZE="-1">2007.03.30  8:02</FONT><UL><LI><A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;op=&amp;threshold=0&amp;commentsort=0&amp;mode=thread&amp;tid=129&amp;tid=100&amp;tid=35&amp;pid=97801#97810">Re:New security method</A>




	
	
	by Anonymous Reader
	



 <FONT SIZE="-1">(Neutral)</FONT>


	<FONT SIZE="-1">2007.03.30  9:43</FONT><UL><LI><A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;op=&amp;threshold=0&amp;commentsort=0&amp;mode=thread&amp;tid=129&amp;tid=100&amp;tid=35&amp;pid=97810#97814">Re:New security method</A>




	
	
	by suso_banderas
	



 <FONT SIZE="-1">(Neutral)</FONT>


	<FONT SIZE="-1">2007.03.30 10:43</FONT><UL></UL></LI><LI><A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;op=&amp;threshold=0&amp;commentsort=0&amp;mode=thread&amp;tid=129&amp;tid=100&amp;tid=35&amp;pid=97810#97817">Re:New security method</A>




	
	
	by Anonymous Reader
	



 <FONT SIZE="-1">(Neutral)</FONT>


	<FONT SIZE="-1">2007.03.30 12:06</FONT><UL></UL></LI></UL></LI></UL></LI><LI><A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;op=&amp;threshold=0&amp;commentsort=0&amp;mode=thread&amp;tid=129&amp;tid=100&amp;tid=35&amp;pid=97799#97806">Re:New security method</A>




	
	
	by Anonymous Reader
	



 <FONT SIZE="-1">(Neutral)</FONT>


	<FONT SIZE="-1">2007.03.30  9:19</FONT><UL></UL></LI></UL></TD></TR><!-- begin dispComment -->


	<TR><TD>
				<FONT FACE="verdana,helvetica,arial" SIZE="+0"><A NAME="97800"></a><B>One question...</B>  <font size="-1">(Neutral)</font>
</FONT>
<div style="padding-left: .4em; margin-top: 0px; border-top: 2px #eeeeee solid;">
<FONT FACE="verdana,helvetica,arial" SIZE="1">By
Anonymous Reader


on 2007.03.30  7:49
 (<A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;cid=97800">#97800</A>)</FONT>



</div>
<div style="padding: .4em; border-top: 1px #dddddd solid; border-bottom: 3px #cccccc solid;">

<font size="-1">"It is wise to create a dummy local user with absolutely no rights on the system and use that user to login into SSH. That way no harm can be done if the user account is compromised. When creating this user, make sure it's in the wheel group, so that you can switch to superuser."<br><br>This maybe a stupid newbie question, but if the attacker gets the low level user's password, isn't that all he needs to use sudo and do what he wants with root access? Please correct me if I'm wrong...<br><br>

	<BR>



</font>

</div>

	</TD></TR>

<!-- begin of dispLinkComment -->
<TR><TD><FONT SIZE="-1">


	
		
		 
		[ 
			
		
			
		<A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;op=Reply&amp;threshold=0&amp;commentsort=0&amp;mode=thread&amp;tid=129&amp;tid=100&amp;tid=35&amp;pid=97800">Reply to This</A>
			
		

		
			
		
			
		


		
		
		

		

		

		


	
		
 ]
</font>
<!-- end of dispLinkComment -->

<!-- end dispComment --><TR><TD><UL><LI><A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;op=&amp;threshold=0&amp;commentsort=0&amp;mode=thread&amp;tid=129&amp;tid=100&amp;tid=35&amp;pid=97800#97802">Re:One question...</A>




	
	
	by Anonymous Reader
	



 <FONT SIZE="-1">(Neutral)</FONT>


	<FONT SIZE="-1">2007.03.30  8:22</FONT><UL></UL></LI><LI><A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;op=&amp;threshold=0&amp;commentsort=0&amp;mode=thread&amp;tid=129&amp;tid=100&amp;tid=35&amp;pid=97800#97803">Yes foolish and point less.</A>




	
	
	by Anonymous Reader
	



 <FONT SIZE="-1">(Neutral)</FONT>


	<FONT SIZE="-1">2007.03.30  8:35</FONT><UL><LI><A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;op=&amp;threshold=0&amp;commentsort=0&amp;mode=thread&amp;tid=129&amp;tid=100&amp;tid=35&amp;pid=97803#97809">Re:Yes foolish and point less.</A>




	
	
	by Anonymous Reader
	



 <FONT SIZE="-1">(Neutral)</FONT>


	<FONT SIZE="-1">2007.03.30  9:38</FONT><UL><LI><A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;op=&amp;threshold=0&amp;commentsort=0&amp;mode=thread&amp;tid=129&amp;tid=100&amp;tid=35&amp;pid=97809#97830">So can changing the port.</A>




	
	
	by Anonymous Reader
	



 <FONT SIZE="-1">(Neutral)</FONT>


	<FONT SIZE="-1">2007.03.30 17:42</FONT><UL><LI><A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;op=&amp;threshold=0&amp;commentsort=0&amp;mode=thread&amp;tid=129&amp;tid=100&amp;tid=35&amp;pid=97830#97840">Re:So can changing the port.</A>




	
	
	by Anonymous Reader
	



 <FONT SIZE="-1">(Neutral)</FONT>


	<FONT SIZE="-1">2007.03.31  7:59</FONT><UL><LI><A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;op=&amp;threshold=0&amp;commentsort=0&amp;mode=thread&amp;tid=129&amp;tid=100&amp;tid=35&amp;pid=97840#97849">Its a different form of knock.</A>




	
	
	by Anonymous Reader
	



 <FONT SIZE="-1">(Neutral)</FONT>


	<FONT SIZE="-1">2007.04.01  8:20</FONT><UL></UL></LI></UL></LI></UL></LI></UL></LI></UL></LI><LI><A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;op=&amp;threshold=0&amp;commentsort=0&amp;mode=thread&amp;tid=129&amp;tid=100&amp;tid=35&amp;pid=97800#97879">Re:One question...</A>




	
	
	by Anonymous Reader
	



 <FONT SIZE="-1">(Neutral)</FONT>


	<FONT SIZE="-1">2007.04.02 18:47</FONT><UL></UL></LI></UL></TD></TR><!-- begin dispComment -->


	<TR><TD>
				<FONT FACE="verdana,helvetica,arial" SIZE="+0"><A NAME="97804"></a><B>AllowUsers</B>  <font size="-1">(Neutral)</font>
</FONT>
<div style="padding-left: .4em; margin-top: 0px; border-top: 2px #eeeeee solid;">
<FONT FACE="verdana,helvetica,arial" SIZE="1">By
Anonymous Reader


on 2007.03.30  8:36
 (<A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;cid=97804">#97804</A>)</FONT>



</div>
<div style="padding: .4em; border-top: 1px #dddddd solid; border-bottom: 3px #cccccc solid;">

<font size="-1">If you have a number of users on a system possibly with weak passwords, you can set the AllowUsers config entry to a list of those who need ssh access (and who should have good passwords).  This will defend against brute force attacks on the other accounts.<br>

	<BR>



</font>

</div>

	</TD></TR>

<!-- begin of dispLinkComment -->
<TR><TD><FONT SIZE="-1">


	
		
		 
		[ 
			
		
			
		<A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;op=Reply&amp;threshold=0&amp;commentsort=0&amp;mode=thread&amp;tid=129&amp;tid=100&amp;tid=35&amp;pid=97804">Reply to This</A>
			
		

		
			
		
			
		


		
		
		

		

		

		


	
		
 ]
</font>
<!-- end of dispLinkComment -->

<!-- end dispComment --><TR><TD><UL></UL></TD></TR><!-- begin dispComment -->


	<TR><TD>
				<FONT FACE="verdana,helvetica,arial" SIZE="+0"><A NAME="97805"></a><B>No need for tcp_wrappers</B>  <font size="-1">(Neutral)</font>
</FONT>
<div style="padding-left: .4em; margin-top: 0px; border-top: 2px #eeeeee solid;">
<FONT FACE="verdana,helvetica,arial" SIZE="1">By
Anonymous Reader


on 2007.03.30  8:41
 (<A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;cid=97805">#97805</A>)</FONT>



</div>
<div style="padding: .4em; border-top: 1px #dddddd solid; border-bottom: 3px #cccccc solid;">

<font size="-1">Actually, you don't need to resort tcp_wrappers or iptables to filter by host.<br>OpenSSH can do this all by itself, with more granularity, thanks to the recent "Match" directive.<br>For instance, here's how we achieve the same things you described on the article :<br><br>Match Address 192.168.1.*, 193.180.177.13<br>
&nbsp; &nbsp; &nbsp; &nbsp; AllowUsers anze dasa kimy<br><br>By the way, some more options have security impact. Consider doing :<br>AddressFamily inet<br>AllowTcpForwarding no<br>MaxAuthTries 3<br><br>To restrict to IPv4 (and reject IPv6), deny tcp forwarding, and circumvent<br>brute force attacks.<br><br>Also, if you don't use PAM, consider using UsePrivilegeSeparation.<br>

	<BR>



</font>

</div>

	</TD></TR>

<!-- begin of dispLinkComment -->
<TR><TD><FONT SIZE="-1">


	
		
		 
		[ 
			
		
			
		<A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;op=Reply&amp;threshold=0&amp;commentsort=0&amp;mode=thread&amp;tid=129&amp;tid=100&amp;tid=35&amp;pid=97805">Reply to This</A>
			
		

		
			
		
			
		


		
		
		

		

		

		


	
		
 ]
</font>
<!-- end of dispLinkComment -->

<!-- end dispComment --><TR><TD><UL><LI><A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;op=&amp;threshold=0&amp;commentsort=0&amp;mode=thread&amp;tid=129&amp;tid=100&amp;tid=35&amp;pid=97805#97837">Yes but foolish.</A>




	
	
	by Anonymous Reader
	



 <FONT SIZE="-1">(Neutral)</FONT>


	<FONT SIZE="-1">2007.03.31  4:47</FONT><UL></UL></LI></UL></TD></TR><!-- begin dispComment -->


	<TR><TD>
				<FONT FACE="verdana,helvetica,arial" SIZE="+0"><A NAME="97807"></a><B>Many misleading "tips"</B>  <font size="-1">(Neutral)</font>
</FONT>
<div style="padding-left: .4em; margin-top: 0px; border-top: 2px #eeeeee solid;">
<FONT FACE="verdana,helvetica,arial" SIZE="1">By
Anonymous Reader


on 2007.03.30  9:25
 (<A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;cid=97807">#97807</A>)</FONT>



</div>
<div style="padding: .4em; border-top: 1px #dddddd solid; border-bottom: 3px #cccccc solid;">

<font size="-1">Some tips are ok, albeit not very innovative at all. I did not understand why I should use tcpwrappers or iptables to limit access from remote IP's, when SSH offers the AllowUsers option. Also, the time limitation trick is more harmful than useful if I want to start two sessions at intervals smaller than 1 minute. Bleh.

	<BR>



</font>

</div>

	</TD></TR>

<!-- begin of dispLinkComment -->
<TR><TD><FONT SIZE="-1">


	
		
		 
		[ 
			
		
			
		<A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;op=Reply&amp;threshold=0&amp;commentsort=0&amp;mode=thread&amp;tid=129&amp;tid=100&amp;tid=35&amp;pid=97807">Reply to This</A>
			
		

		
			
		
			
		


		
		
		

		

		

		


	
		
 ]
</font>
<!-- end of dispLinkComment -->

<!-- end dispComment --><TR><TD><UL></UL></TD></TR><!-- begin dispComment -->


	<TR><TD>
				<FONT FACE="verdana,helvetica,arial" SIZE="+0"><A NAME="97812"></a><B>PermitRootLogin no</B>  <font size="-1">(Neutral)</font>
</FONT>
<div style="padding-left: .4em; margin-top: 0px; border-top: 2px #eeeeee solid;">
<FONT FACE="verdana,helvetica,arial" SIZE="1">By
Anonymous Reader


on 2007.03.30  9:56
 (<A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;cid=97812">#97812</A>)</FONT>



</div>
<div style="padding: .4em; border-top: 1px #dddddd solid; border-bottom: 3px #cccccc solid;">

<font size="-1">The default in ALT Linux (it was also privsep'ed quite before the feature got official).<br><br>--<br>Michael Shigorin

	<BR>



</font>

</div>

	</TD></TR>

<!-- begin of dispLinkComment -->
<TR><TD><FONT SIZE="-1">


	
		
		 
		[ 
			
		
			
		<A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;op=Reply&amp;threshold=0&amp;commentsort=0&amp;mode=thread&amp;tid=129&amp;tid=100&amp;tid=35&amp;pid=97812">Reply to This</A>
			
		

		
			
		
			
		


		
		
		

		

		

		


	
		
 ]
</font>
<!-- end of dispLinkComment -->

<!-- end dispComment --><TR><TD><UL></UL></TD></TR><!-- begin dispComment -->


	<TR><TD>
				<FONT FACE="verdana,helvetica,arial" SIZE="+0"><A NAME="97823"></a><B>nothing advanced here</B>  <font size="-1">(Neutral)</font>
</FONT>
<div style="padding-left: .4em; margin-top: 0px; border-top: 2px #eeeeee solid;">
<FONT FACE="verdana,helvetica,arial" SIZE="1">By
Anonymous Reader


on 2007.03.30 14:00
 (<A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;cid=97823">#97823</A>)</FONT>



</div>
<div style="padding: .4em; border-top: 1px #dddddd solid; border-bottom: 3px #cccccc solid;">

<font size="-1"><p>None of this is advanced, and none of this hasn't been published before.  Come on... how many times do we have to hear the same thing (that's common sense, for crying out loud).</p>

<p>No one should be using protocol 1 unless they absolutely have to.  No one should be using passwords with the root account (turn it off or use without-password which is great for rsync over ssh to do privileged backups).  This article doesn't even go into the ~/.ssh/authorized_keys file and how you can use the command directive to restrict actions!</p>

<p>If you want something "advanced", check out <a href="http://linsec.ca/Optimizing_OpenSSH" title="linsec.ca" rel="nofollow">linsec.ca</a> [linsec.ca]'s ssh article.  It's a little old, and could use some updating for things like the new Match directive and stuff, but it's <i>far</i> more advanced than this drivel.</p>

<p>If I was linux.com, I'd be embarrassed to put this one up.</p>

	<BR>



</font>

</div>

	</TD></TR>

<!-- begin of dispLinkComment -->
<TR><TD><FONT SIZE="-1">


	
		
		 
		[ 
			
		
			
		<A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;op=Reply&amp;threshold=0&amp;commentsort=0&amp;mode=thread&amp;tid=129&amp;tid=100&amp;tid=35&amp;pid=97823">Reply to This</A>
			
		

		
			
		
			
		


		
		
		

		

		

		


	
		
 ]
</font>
<!-- end of dispLinkComment -->

<!-- end dispComment --><TR><TD><UL><LI><A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;op=&amp;threshold=0&amp;commentsort=0&amp;mode=thread&amp;tid=129&amp;tid=100&amp;tid=35&amp;pid=97823#97828">why so hostile?</A>




	
	
	by Anonymous Reader
	



 <FONT SIZE="-1">(Neutral)</FONT>


	<FONT SIZE="-1">2007.03.30 16:59</FONT><UL><LI><A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;op=&amp;threshold=0&amp;commentsort=0&amp;mode=thread&amp;tid=129&amp;tid=100&amp;tid=35&amp;pid=97828#97845">Re:why so hostile?</A>




	
	
	by Anonymous Reader
	



 <FONT SIZE="-1">(Neutral)</FONT>


	<FONT SIZE="-1">2007.03.31 17:47</FONT><UL></UL></LI></UL></LI></UL></TD></TR><!-- begin dispComment -->


	<TR><TD>
				<FONT FACE="verdana,helvetica,arial" SIZE="+0"><A NAME="97851"></a><B>good article</B>  <font size="-1">(Neutral)</font>
</FONT>
<div style="padding-left: .4em; margin-top: 0px; border-top: 2px #eeeeee solid;">
<FONT FACE="verdana,helvetica,arial" SIZE="1">By
<A HREF="//www.linux.com/~manuel80">manuel80 (233774)</A>


on 2007.04.01 14:00
 (<A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;cid=97851">#97851</A>)</FONT>


	<BR><FONT FACE="verdana,helvetica,arial" SIZE="1" color="#666666">(
	
		<A HREF="http://www.kahuki.com/">http://www.kahuki.com/</A>
		
	
	
	)</FONT>


</div>
<div style="padding: .4em; border-top: 1px #dddddd solid; border-bottom: 3px #cccccc solid;">

<font size="-1">There are some tips in this article, that where new to me. Thanks!

	<BR>



</font>

</div>

	</TD></TR>

<!-- begin of dispLinkComment -->
<TR><TD><FONT SIZE="-1">


	
		
		 
		[ 
			
		
			
		<A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;op=Reply&amp;threshold=0&amp;commentsort=0&amp;mode=thread&amp;tid=129&amp;tid=100&amp;tid=35&amp;pid=97851">Reply to This</A>
			
		

		
			
		
			
		


		
		
		

		

		

		


	
		
 ]
</font>
<!-- end of dispLinkComment -->

<!-- end dispComment --><TR><TD><UL></UL></TD></TR><!-- begin dispComment -->


	<TR><TD>
				<FONT FACE="verdana,helvetica,arial" SIZE="+0"><A NAME="97855"></a><B>this is standard - for advance use try pam_tally</B>  <font size="-1">(Neutral)</font>
</FONT>
<div style="padding-left: .4em; margin-top: 0px; border-top: 2px #eeeeee solid;">
<FONT FACE="verdana,helvetica,arial" SIZE="1">By
Anonymous Reader


on 2007.04.02  4:12
 (<A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;cid=97855">#97855</A>)</FONT>



</div>
<div style="padding: .4em; border-top: 1px #dddddd solid; border-bottom: 3px #cccccc solid;">

<font size="-1">this is a german how-to for the not so well documented pam_tally module:<br><a href="http://www.administrator.de/Kurzanleitung_(HowTo)_zur_Konfiguration_des_Linux_PAM_Moduls_pam_tally_am_Beispiel_des_SSH_Daemons.html" title="administrator.de" rel="nofollow">http://www.administrator.de/Kurzanleitung_(HowTo)<nobr>_<wbr></nobr> zur_Konfiguration_des_Linux_PAM_Moduls_pam_tally_<nobr>a<wbr></nobr> m_Beispiel_des_SSH_Daemons.html</a> [administrator.de]<br><a href="http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/sag-pam_tally.html" title="kernel.org" rel="nofollow">http://www.kernel.org/pub/linux/libs/pam/Linux-PA<nobr>M<wbr></nobr> -html/sag-pam_tally.html</a> [kernel.org]

	<BR>



</font>

</div>

	</TD></TR>

<!-- begin of dispLinkComment -->
<TR><TD><FONT SIZE="-1">


	
		
		 
		[ 
			
		
			
		<A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;op=Reply&amp;threshold=0&amp;commentsort=0&amp;mode=thread&amp;tid=129&amp;tid=100&amp;tid=35&amp;pid=97855">Reply to This</A>
			
		

		
			
		
			
		


		
		
		

		

		

		


	
		
 ]
</font>
<!-- end of dispLinkComment -->

<!-- end dispComment --><TR><TD><UL><LI><A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;op=&amp;threshold=0&amp;commentsort=0&amp;mode=thread&amp;tid=129&amp;tid=100&amp;tid=35&amp;pid=97855#97868">Restrictions based on authorized key</A>




	
	
	by andmalc
	



 <FONT SIZE="-1">(Neutral)</FONT>


	<FONT SIZE="-1">2007.04.02 11:18</FONT><UL></UL></LI></UL></TD></TR><!-- begin dispComment -->


	<TR><TD>
				<FONT FACE="verdana,helvetica,arial" SIZE="+0"><A NAME="97869"></a><B>Article title</B>  <font size="-1">(Neutral)</font>
</FONT>
<div style="padding-left: .4em; margin-top: 0px; border-top: 2px #eeeeee solid;">
<FONT FACE="verdana,helvetica,arial" SIZE="1">By
Anonymous Reader


on 2007.04.02 12:09
 (<A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;cid=97869">#97869</A>)</FONT>



</div>
<div style="padding: .4em; border-top: 1px #dddddd solid; border-bottom: 3px #cccccc solid;">

<font size="-1">Title should probably be changed from "Advanced SSH security tips and tricks" to "Standard steps for locking down sshd".<br><br>Here's what counts from the article:<br>* Pubkey authentication only (disable other authentication).<br>* Disable protocol 1.<br>* Disallow root login.<br>* Enable firewall rules that allow only subnets that need access. Deny everything else.

	<BR>



</font>

</div>

	</TD></TR>

<!-- begin of dispLinkComment -->
<TR><TD><FONT SIZE="-1">


	
		
		 
		[ 
			
		
			
		<A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;op=Reply&amp;threshold=0&amp;commentsort=0&amp;mode=thread&amp;tid=129&amp;tid=100&amp;tid=35&amp;pid=97869">Reply to This</A>
			
		

		
			
		
			
		


		
		
		

		

		

		


	
		
 ]
</font>
<!-- end of dispLinkComment -->

<!-- end dispComment --><TR><TD><UL></UL></TD></TR><!-- begin dispComment -->


	<TR><TD>
				<FONT FACE="verdana,helvetica,arial" SIZE="+0"><A NAME="97871"></a><B>Disallowing root login</B>  <font size="-1">(Neutral)</font>
</FONT>
<div style="padding-left: .4em; margin-top: 0px; border-top: 2px #eeeeee solid;">
<FONT FACE="verdana,helvetica,arial" SIZE="1">By
Anonymous Reader


on 2007.04.02 14:41
 (<A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;cid=97871">#97871</A>)</FONT>



</div>
<div style="padding: .4em; border-top: 1px #dddddd solid; border-bottom: 3px #cccccc solid;">

<font size="-1"><blockquote><div>You should not permit root logins via SSH, because this is a big and unnecessary security risk.</div></blockquote>

<p>Why ?  How is it a risk ?  The SSHv2 protocol is believed to be impervious to snooping, and if you already allow only key-based authentication, then you are as close as you can get to a system where credentials cannot brute-forced.  What does disallowing root login give you above that ?</p>

<p>Don't tell me that people should not login as root as a matter of policy.  If a user can use su, or sudo -s, or sudo su, then that user is effectively root, and locking the root account in SSH does not help a single bit in this regard.</p>

	<BR>



</font>

</div>

	</TD></TR>

<!-- begin of dispLinkComment -->
<TR><TD><FONT SIZE="-1">


	
		
		 
		[ 
			
		
			
		<A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;op=Reply&amp;threshold=0&amp;commentsort=0&amp;mode=thread&amp;tid=129&amp;tid=100&amp;tid=35&amp;pid=97871">Reply to This</A>
			
		

		
			
		
			
		


		
		
		

		

		

		


	
		
 ]
</font>
<!-- end of dispLinkComment -->

<!-- end dispComment --><TR><TD><UL><LI><A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;op=&amp;threshold=0&amp;commentsort=0&amp;mode=thread&amp;tid=129&amp;tid=100&amp;tid=35&amp;pid=97871#97877">Re:Disallowing root login</A>




	
	
	by Anonymous Reader
	



 <FONT SIZE="-1">(Neutral)</FONT>


	<FONT SIZE="-1">2007.04.02 17:24</FONT><UL><LI><A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;op=&amp;threshold=0&amp;commentsort=0&amp;mode=thread&amp;tid=129&amp;tid=100&amp;tid=35&amp;pid=97877#97881">Re:Disallowing root login</A>




	
	
	by Anonymous Reader
	



 <FONT SIZE="-1">(Neutral)</FONT>


	<FONT SIZE="-1">2007.04.02 20:14</FONT><UL></UL></LI></UL></LI><LI><A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;op=&amp;threshold=0&amp;commentsort=0&amp;mode=thread&amp;tid=129&amp;tid=100&amp;tid=35&amp;pid=97871#98153">Re:Disallowing root login</A>




	
	
	by Anonymous Reader
	



 <FONT SIZE="-1">(Neutral)</FONT>


	<FONT SIZE="-1">2007.04.11 14:43</FONT><UL></UL></LI></UL></TD></TR><!-- begin dispComment -->


	<TR><TD>
				<FONT FACE="verdana,helvetica,arial" SIZE="+0"><A NAME="98013"></a><B>Log files</B>  <font size="-1">(Neutral)</font>
</FONT>
<div style="padding-left: .4em; margin-top: 0px; border-top: 2px #eeeeee solid;">
<FONT FACE="verdana,helvetica,arial" SIZE="1">By
Anonymous Reader


on 2007.04.08 19:27
 (<A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;cid=98013">#98013</A>)</FONT>



</div>
<div style="padding: .4em; border-top: 1px #dddddd solid; border-bottom: 3px #cccccc solid;">

<font size="-1">I think that the idea of 'securing up' ssh is to<br>make it so that you're not under constant attack.<br><br>The only thing which really saves you from being hacked is strong passwords and a secure protocol.<br><br>I opened up port 22 and my logs filled with junk, but I never felt that those script kiddies were any closer to getting in.<br><br>The problem is that I like to read<nobr> <wbr></nobr>/var/log/secure<br>

	<BR>



</font>

</div>

	</TD></TR>

<!-- begin of dispLinkComment -->
<TR><TD><FONT SIZE="-1">


	
		
		 
		[ 
			
		
			
		<A HREF="//enterprise.linux.com/comments.pl?sid=38274&amp;op=Reply&amp;threshold=0&amp;commentsort=0&amp;mode=thread&amp;tid=129&amp;tid=100&amp;tid=35&amp;pid=98013">Reply to This</A>
			
		

		
			
		
			
		


		
		
		

		

		

		


	
		
 ]
</font>
<!-- end of dispLinkComment -->

<!-- end dispComment --><TR><TD><UL></UL></TD></TR>






</table>
</FORM>


</div>
</div>

<!-- end template: ID 237, printCommComments;misc;default -->



<!-- start template: ID 203, footer;misc;default -->

&nbsp;
				</div>
                        </div>
                        <div class="content_btm">
                                <div class="content_btm3">
                                        <div class="content_btm2"></div>
                                </div>
                        </div>


      
        
        
 
        <table width="100%" cellspacing="0" cellpadding="0" class="greypos"><tr><td><div class="grycontent_top"><div class="grycontent_top3"><div class="grycontent_top2"></div></div></div><div class="grycontent">
               
                        <div style="border-bottom: 1px solid #666; color: #666; font-size: 11px; padding: .4em; padding-left: 0; margin-bottom: .4em;"><b>OSTG Services</b></div>
<p><a href="http://jobs.linux.com">Jobs</a></p>
                        <div style="border-bottom: 1px solid #666; color: #666; font-size: 85%; padding: .4em; margin-bottom: .4em;"><b>Special Offers</b></div>
<form name="nc" method="post" action="http://newsletters.osdn.com/signup.pl">
  <input type="hidden" name="source" value="lc">
  <input type="hidden" name="tmpchk" value="1">
			<b>Get special offers on:</b><br />
    			<input type="checkbox"  name="listname" value="OSDN/linux.list">Linux
    			<input type="checkbox"  name="listname" value="OSDN/application_development.list">Application Dev
    			<input type="checkbox"  name="listname" value="OSDN/computer_programming.list">Programming
    			<input type="checkbox"  name="listname" value="OSDN/software.list">Software
    			&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Email:
      		<input type="text" name="email_address" size="10" value=""> 
      		<input type="hidden" name="source" value="standalone">
      		<input type="hidden" name="tmpchk" value="standalone">
	 		<input type="submit" name="Submit" value="Submit">
		
</form>
                        
                
                <table width="90%"><tr><td></td></tr></table>
                
                        <table width="90%"><tr><td><!-- ad position 10 -->
<div id="fad10">
<!-- DoubleClick Ad Tag -->
<script type="text/javascript">
    document.write('<script type="text/javascript" src="http://ad.doubleclick.net/adj/ostg.linux/enterprise_p10_bottom_2nd;pg=article;logged_in=0;tile='+dfp_tile+';tpc=tips;tpc=enterprise;tpc=security;tpc=networking;tpc=sysadmin;ord='+dfp_ord+'?"><\/script>');
    dfp_tile++;
</script>
</div>
<!-- End DoubleClick Ad Tag --></td></tr></table>
               

        </div><div class="grycontent_btm"><div class="grycontent_btm3"><div class="grycontent_btm2"></div></div></div></td></tr></table> 

        
                <table width="100%" cellspacing="0" cellpadding="0" class="greypos"><tr><td><div class="grycontent_top"><div class="grycontent_top3"><div class="grycontent_top2"></div></div></div><div class="grycontent">
                        <table width="90%"><tr><td><!-- ad position 7 -->
<div id="fad7">
<!-- DoubleClick Ad Tag -->
<script type="text/javascript">
    document.write('<script type="text/javascript" src="http://ad.doubleclick.net/adj/ostg.linux/enterprise_p7_bottom_1st;pg=article;logged_in=0;tile='+dfp_tile+';tpc=tips;tpc=enterprise;tpc=security;tpc=networking;tpc=sysadmin;ord='+dfp_ord+'?"><\/script>');
    dfp_tile++;
</script>
</div>
<!-- End DoubleClick Ad Tag --></td></tr></table>
                </div><div class="grycontent_btm"><div class="grycontent_btm3"><div class="grycontent_btm2"></div></div></div></td></tr></table>
        
        
        
                </td><td valign="top">
                
                        <p></p>
                
                
                        
                
                
                        <p></p>
                
        

		</td> 
	</tr> 
</table>
<div align="center">
	<small class="ostgnavbar">-advertisement-</small><br>

        <!-- ad position 5 -->
<div id="fad5">
<!-- DoubleClick Ad Tag -->
<script type="text/javascript">
    document.write('<script type="text/javascript" src="http://ad.doubleclick.net/adj/ostg.linux/enterprise_p5_bottom_leader;pg=article;logged_in=0;tile='+dfp_tile+';tpc=tips;tpc=enterprise;tpc=security;tpc=networking;tpc=sysadmin;ord='+dfp_ord+'?"><\/script>');
    dfp_tile++;
</script>
</div>
<!-- End DoubleClick Ad Tag -->

</div>
<TABLE WIDTH="728" BORDER="0" CELLPADDING="8" CELLSPACING="0" align="center">
        <TR>
                <TD ALIGN="CENTER">


<h5 class="ostgnavbar">
<!-- begin ostg block -->

<p ALIGN="center">&copy; Copyright 2007 - <a HREF="http://www.ostg.com/" class="ostgnavbar">OSTG</a>, Inc., All Rights Reserved<br />

About <a HREF="/about.tmpl"  class="ostgnavbar">Linux.com</a> &nbsp;-&nbsp; <a HREF="//www.linux.com/relocate.pl?id=1ad10052b832587125eabf077ae1195f" class="ostgnavbar">Privacy Statement</a> &nbsp;-&nbsp; <a HREF="//www.linux.com/relocate.pl?id=23c6051ff9d68c7002cf3fbed0a9b51e" class="ostgnavbar">Terms of Use</a> &nbsp;-&nbsp; <a HREF="//www.linux.com/relocate.pl?id=4868fd76afdfe8b3247984f9aa8b8e2d" class="ostgnavbar">Advertise</a>  &nbsp;-&nbsp; <a HREF="mailto:info@linux.com" class="ostgnavbar">Contact Us</a>


<!-- end ostg block -->
<br />
<font class="ostgnavbar">
<a href="http://www.newsforge.com" class="ostgnavbar">NewsForge</a> --online technology news on Open Source, Linux and IT.
</font>
<br />
<a href="//enterprise.linux.com/enterprise.rss" class="ostgnavbar"><img src="//66.35.250.54/xml.gif" border="0" height="14" width="36" align="absmiddle"> Add our feed to your site</a>
</h5>
</TD>
        </TR>
</TABLE>

<script src="http://www.google-analytics.com/urchin.js" type="text/javascript"></script>
<script type="text/javascript">
	_uacct = "UA-32013-3";
	_udn = "linux.com";
	urchinTracker();
</script>
</BODY>
</HTML>

<!-- end template: ID 203, footer;misc;default -->

