Linux-Sec.net

If you want/have a ( ssh/ssl based ) secure "login" server ...
- You should have different passwd for each service and servers
- You should NOT run telnet, use ssh securely instead
- You should NOT run ftp, use scp securely instead
- You should NOT run pop3/imap, use secure pop3s/imaps instead
- You should NOT run ppp, put it on a different server...
- You should NOT run dhcp, put it on a different server...
- You should NOT run wireless, put it on a different server...
- Put VPN/SSH connections from their home OUTSIDE your firewall, NOT inside on your important corp lan
- Put laptops OUTSIDE your firewall, NOT inside on your important corp lan
- Those (insecure) services should be on a separate insecure server on an insecure private LAN outside your firewall - do NOT trust those insecure services

Minimum Recommendations

Download and install the latest ssh from OpenSSH.org
-- or --
Download and install the latest ssh from SSH
Download and install the latest ssl from OpenSSL.org
Download and install the latest VPN if you still insist on allowing insecure connections from "home" where you, the corp admin, have zero control of their home network/environment

SSH Clients for Microsoft Windows

SSH Mailing List and Archives

If they didn't get in, you just recieved a free 5-second audit of your system
Assuming that your sshd has been compiled with tcp_wrappers
vi /etc/hosts.allow
vi /etc/hosts.deny
now try to login from those ip# and see if it works
try to login from other machines and see if you get an error message
- ssh_exchange_identification: Connection closed by remote host
Other ways to block incoming ssh connection attempts
- Port Knocking -- if you can knock .. they can too
You're in trouble ( cracked ) if you see something like this
- ( we're assuming that your libraries and binaries have not been modified to hide the crackers )
- netstat -v
```
 tcp 0 0 your-PC:port# hackers-ip:ssh  ESTABLISHED 
```
- grep sshd /var/log/{messages,auth,syslog}
```
 Oct 27 22:58:55 YourPC sshd[pid]: Accepted password for USER from hacker-ip# port number ssh2 
```