SSH server attacks resurface

Admins are being urged to use tougher usernames and passwords

Security researchers are warning administrators to secure their servers in the wake of new Secure Shell (SSH) attacks.

Researchers at security firm SANS warned that so-called "brute force" attacks were occurring on a daily basis. The attacks attempt to guess usernames and passwords in order to compromise the server.

To help guard against the attacks, SANS researcher Daniel Wesemann recommended that administrators try to make both usernames and passwords more difficult for attackers to guess.

"If you are running any SSH server open to the internet, and your usernames and passwords aren't at least eight characters or so, your box is either owned by now, or about to be," explained Wesemann.

"It doesn't matter one bit what sort of device it is - those who run these scans have proven to be equally apt at taking over a Cisco router as they are at subverting an iMac."

In addition to complicating usernames and passwords, Wesemann also suggested that administrators use other simple measures such as moving SSH off of port 22 and monitor logs for suspicious activity. While the measures will not prevent an attack, Wesemann said that they would at least make compromising a machine more difficult.

"Yes we know that picking complicated usernames and moving SSH off port 22 are 'security by obscurity' and not real security," Wesemann admitted. "But fact is that they both help to thwart the rampant brute force attacks. Bulletproof is nice, but if it can't be had, good camouflage sure beats being a plum target!"