practically need to rotate logs every hour if you foolishly leave ssh open on a open network. usually a bastion with ssh listening to port 34000 or such is a good first step.
that said the conditions for this exploit are fascinating. no pam, shadow password set to *, using a alternative to glibc. The sacrifices to be more efficient feel on par with replacing a tank’s armor with paper mache and hope.
I got into it with another sys admin on shifting port numbers. “Security through obscurity is not security!” to which I responded “Obscurity cuts out most of the bots” (therefore easier to spot real threats).
Eventually we just went the secret squirrel bastion route.
practically need to rotate logs every hour if you foolishly leave ssh open on a open network. usually a bastion with ssh listening to port 34000 or such is a good first step.
that said the conditions for this exploit are fascinating. no pam, shadow password set to *, using a alternative to glibc. The sacrifices to be more efficient feel on par with replacing a tank’s armor with paper mache and hope.
The best armor is to not get hit!
I got into it with another sys admin on shifting port numbers. “Security through obscurity is not security!” to which I responded “Obscurity cuts out most of the bots” (therefore easier to spot real threats).
Eventually we just went the secret squirrel bastion route.