<html><body><div style="font-family: Arial; font-size: 12pt; color: #000000"><div aria-label="Compose body">And of course, simple things like:<br></div><div aria-label="Compose body"> <br></div><div aria-label="Compose body"> Don't allow the root user to login via ssh. Hey, doing the su/sudo thing from a different login account doesn't take all the much time.<br></div><div aria-label="Compose body"> Change the ssh port to something oddball. I've even stopped using 222 as it's somewhat common.<br></div><div aria-label="Compose body"> When setting a password, if it tells you it's in the dictionary, use something else. No matter how "cool" or "easy" it is.<br></div><div aria-label="Compose body"> At the very least, close off ALL the normal SIP ports. If you MUST use SIP for some god forsaken reason, move it to oddball ports.<br></div><div aria-label="Compose body"> Consider moving your IAX port to something non-standard.<br></div><div aria-label="Compose body"> </div><div aria-label="Compose body">Even with a router with appropriate security, I've considered putting up an RPi as a site SSH gateway. So that the Asterisk boxes are only exposed to the outside world on the IAX port. Forward whatever port I'm using for SSH to the RPi, log into it, and from there to the other machines at the site. Might even be a convenient place to run AllMon.... </div><div><br></div><div>Why do I say all this..... I violated all of those suggestions due to over confidence, and laziness. It took them several years, but they got in. At first "all" they did was disable cron, and later remove it. Further on, they changed the root password. Still not sure what they were up to. They did nothing to Asterisk. When building the new machine, I took better precautions.<br></div><div><br></div><div>In the long view... it's kind of like what a cop told us when he came to investigate a break in at our club site years ago.<br></div><div>"You can't keep them out. So do all you can to slow them down....</div><div><br></div><div><br></div><div><span name="x"></span><div><div><span style="FONT-WEIGHT: bold; FONT-FAMILY: arial"><span style="FONT-SIZE: 12px; FONT-STYLE: italic"><span style="FONT-SIZE: 12px; FONT-STYLE: italic">
<div> </div>
<div><span style="FONT-WEIGHT: bold; FONT-FAMILY: arial"><font size="3">Robert A. Poff<br></font></span><span style="FONT-WEIGHT: bold; FONT-FAMILY: arial"><font size="3">Loganville, PA.</font><br><span style="FONT-SIZE: 12px; FONT-STYLE: italic"></span></span></div><div><span style="FONT-WEIGHT: bold; FONT-FAMILY: arial"><span style="FONT-SIZE: 12px; FONT-STYLE: italic"><span style="FONT-SIZE: 12px; FONT-STYLE: italic"><span style="FONT-WEIGHT: bold; FONT-FAMILY: arial"><span style="FONT-SIZE: 12px; FONT-STYLE: italic"><span style="FONT-SIZE: 12px; FONT-STYLE: italic"><span style="FONT-WEIGHT: bold; FONT-FAMILY: arial"><span style="FONT-SIZE: 12px; FONT-STYLE: italic"><br></span></span></span></span></span></span></span></span></div><div><span style="FONT-WEIGHT: bold; FONT-FAMILY: arial"><span style="FONT-SIZE: 12px; FONT-STYLE: italic"><span style="FONT-SIZE: 12px; FONT-STYLE: italic"><span style="FONT-WEIGHT: bold; FONT-FAMILY: arial"><span style="FONT-SIZE: 12px; FONT-STYLE: italic">1983 Hunter 34</span></span></span></span></span></div><div><span style="FONT-WEIGHT: bold; FONT-FAMILY: arial"><span style="FONT-SIZE: 12px; FONT-STYLE: italic">Havre de Grace, MD</span></span></div><div><span style="FONT-WEIGHT: bold; FONT-FAMILY: arial"><span style="FONT-SIZE: 12px; FONT-STYLE: italic"><br><span style="FONT-SIZE: 12px; FONT-STYLE: italic">"Lieutenant, target the offending power boat and launch photon torpedoes" </span></span></span></div></span></span></span></div></div><span name="x"></span><div><br></div></div><div><br></div></div></body></html>