Brute force protection
Best idea ever!!!
this post was submitted on 13 Mar 2024
1018 points (96.9% liked)
Memes
45559 readers
1417 users here now
Rules:
- Be civil and nice.
- Try not to excessively repost, as a rule of thumb, wait at least 2 months to do it if you have to.
founded 5 years ago
MODERATORS
Fine I'll just change my password to what I thought it should be.
*New password cannot match old password
Add a randomizer with 50/50 succeeding for this error
I remember in college editing OpenSSH source code to instead of return wrong password to a root shell prompt just to stop brute force attacks
@Pacmanlives
Couldn't you just disable root login in the sshd config?
Oh all of my configs are deny root ssh login or without-password. I noticed a significant decrease in scans when returning a root prompt when I did that. This was also in the mid 2000s so who knows how things would be in this day in age for a reduction in scans
@Pacmanlives
So it was a fake root prompt which tricked the bots into believing that they logged in successfully but in reality the prompt could do nothing on the system?
Correct
But... arent they logged in as root then? Wdym with "prompt" i am lost
A honeypot!
Not to be pedantic but wouldn't it be IsFirstLoginWithAttemptedPassword or am I missing something?
You're right, and nothing wrong with being pedantic when working with code :)
No, it's correct - say your password gets leaked across thousands of passwords. A hacker will try to crack all of them with a program that guesses them once, which as the image suggests defeats these types of programs
no, since it first checks if the password is correct. if it is, display error message. if it is corrent and the second time, accept the password (code not in screenshot) but if the password is wrong, it doesnt check if it is the first attempt.
How does that stop a brute force attack? As written, it only stops the single luckiest brute force attack that happens to get the password right on their first try.
It wouldn't stop most brute force attacks, which are not performed on the live web service, but rather on a password hasb list that was stolen via some other means.
You can't really prevent a brute force attack. Even if you prevent it from one IP or so, you can still do "distributed" brute force attacks.
Also only allowing one password per 5 seconds or so per IP will not work if you have lots of users and they are at work and have the same IP.
view more: next ›