1

I must admit I didn't now what ssh is until just a while ago when I got annoyed from those authentication logs from sshd.

I searched a bit and was surprised that these authentication attempts were actually trying to access my shell remotely probably to do something bad with my personal data.

The current system I'm playing with is a fresh FreeBSD install which had sshd on by default during installation. I didn't know what it was then so I just blindly followed the defaults. I checked with ps and got scared that there are 2 unknown connections accepted by sshd. My root password is only 2 letters, so it seems some of those bruteforce attacks has succeeded. I'm trying to do my best in order not to let something like this happen again, and I wonder if turning off sshd by default is okay if I'm just using this system as a personal desktop.

2
  • 1
    Set a stronger root password. Disable password login for root via ssh (see sshd_config(5)). Only allow ssh from local or trusted networks via the firewall for e.g. git push/pull via ssh to/from virts.
    – thrig
    Mar 9, 2017 at 15:33
  • Also, important to note: if an attacker has gained root on your system, you really need to format and reinstall. The attacker could have left a back door (etc.)
    – derobert
    Mar 9, 2017 at 16:01

2 Answers 2

Reset to default
4

sshd is for remote access to the machine. If you don't want to access it from network, than it is safe (and really good idea) to disable it and keep it down.

0

Sure, you can turn off or even delete ssh server from your system.

Anyway, if someone was able to login to your desktop through SSH, they were able somewhat to get network access to it. If the access was from external, then you also should take a look to your NAT/Port Forwarding rules, I'm afraid that this was not the only security issue you had in your environment. If you find that the access were internal, take care about the devices connected to your network!

You must log in to answer this question.