Linux - SecurityThis forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
Could someone please explain me how the brute force attacks on my ssh server are supposed to work? Ssh still asks for a password even though the username is unknown. That would mean that the attacker, when going through his alphabetical list of usernames, won't know if any of the usernames was correct or not. That again would mean that to successfully gain access through a brute force attack he would need to go through all possible usernames combined with all possible passwords, wouldn't it?
That would take a zillion tries and a lot of time, so why are people still bothering to attack my box for ten minutes, going through the alphabetical list once, and then stop? Can they deduce usernames somehow or are they just plain stupid?
These sorts of attacks don't really concern themselves with going through all possible combinations of usernames and passwords because that is just plain stupid. Instead, they tend to go for obvious combinations. Most machines are going to have a user root, so that is one to try along with obivious passwords like toor or password. These sorts of attacks really depend on the user being careless and not using strong passwords. The fact that these sorts of attacks persist suggest that such careless users are depressingly common.
That again would mean that to successfully gain access through a brute force attack he would need to go through all possible usernames combined with all possible passwords, wouldn't it?
Yes, for a true brute force,that's how it works. Which is why brute force attacks are not very effective against systems that have username/passwords that are reasonably random and include numbers and punctuation. However, if you allow "root" to login directly over ssh, then the attacker will know the most important username on the system...root.
That would take a zillion tries and a lot of time, so why are people still bothering to attack my box for ten minutes, going through the alphabetical list once, and then stop?
Exactly. Which is why these attacks are only effective against systems that have very poor passwords, like root/root, admin/admin, etc. Technically most of the attacks you'll see are called 'dictionary attacks' and use a list of words of phrases rather than iterating through letters like "aaaaaa" to "zzzzzz" (really it would be "a" to "zzzzzz").
Can they deduce usernames somehow or are they just plain stupid?
No, they can't deduce usernames (other than "root"), but what they *are* looking for are lazy or stupid administrators who use bad passwords.
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.