SSH server attacks resurface

Researchers at security firm SANS warned that so-called 'brute force' attacks were occurring on a "daily" basis.

The attacks attempt to guess usernames and passwords in an attempt to compromise the server.

To help guard against the attacks, SANS researcher Daniel Weseman recommended that administrators help guard against the attacks by making both usernames and passwords more difficult for attackers to guess.

"If you are running any SSH server open to the internet, and your usernames and passwords aren't at least 8 characters or so, your box is either owned by now, or about to be," explained Wesemann.

"It doesn't matter one bit what sort of device it is - those who run these scans have proven to be equally apt at taking over a Cisco router as they are at subverting an iMac."

In addition to complicating usernames and passwords, Weseman also suggested that administrators use other simple measures such as moving SSH off of port 22 and monitor logs for suspicious activity.

While the measures will not prevent an attack, Weseman said that they would at least make compromising a machine for difficult.

"Yes we know that picking complicated usernames and moving SSH off port 22 are 'security by obscurity' and not real security," Weseman admitted.

"But fact is that they both help to thwart the rampant brute force attacks. Bulletproof is nice, but if it can't be had, good camouflage sure beats being a plum target."