<HTML><HEAD>
<STYLE id=eMClientCss>blockquote.cite { margin-left: 5px; margin-right: 0px; padding-left: 10px; padding-right:0px; border-left: 1px solid #cccccc }
blockquote.cite2 {margin-left: 5px; margin-right: 0px; padding-left: 10px; padding-right:0px; border-left: 1px solid #cccccc; margin-top: 3px; padding-top: 0px; }
.plain pre, .plain tt { font-family: monospace; font-size: 100%; font-weight: normal; font-style: normal;}
a img { border: 0px; }body {font-family: Tahoma;font-size: 12pt;}
.plain pre, .plain tt {font-family: Tahoma;font-size: 12pt;}
</STYLE>
<STYLE></STYLE>
</HEAD>
<BODY scroll=auto bgColor=#ffffff class>
<DIV>Thanks George, that's very good advice, will do that right away. It's funny, on my home router which runs OpenWRT, I actually disabled password login and set up public key auth. i did that for fun when I though of pki one day and didn't realize the importance of that.</DIV>
<DIV> </DIV>
<DIV>------ Original Message ------</DIV>
<DIV>From: "George Mason" <<A href="mailto:george.mason@xoomtalk.com">george.mason@xoomtalk.com</A>></DIV>
<DIV>To: <A href="mailto:spce-user@lists.sipwise.com">spce-user@lists.sipwise.com</A></DIV>
<DIV>Sent: 2016-04-20 10:22:42 AM</DIV>
<DIV>Subject: Re: [Spce-user] iptables issue</DIV>
<DIV> </DIV>
<DIV id=x736e26fb7a1e4169835d0a536748fe37 style="COLOR: #000000">
<BLOCKQUOTE class=cite2 cite=5717BAE2.4050305@xoomtalk.com type="cite"><FONT face=Arial>Hi Jonathan<BR><BR>I would strongly advise against *ever* using password based SSH authentication - even if using fail2ban I would not expose a server to the Internet without public key authentication enabled (and password authentication disabled).<BR><BR>More info available here: <A class=moz-txt-link-freetext href="https://macnugget.org/projects/publickeys/">https://macnugget.org/projects/publickeys/</A><BR></FONT>
<DIV class=moz-signature><FONT style="FONT-FAMILY: Arial" size=2 face=Arial><BR><FONT color=#7b7979 size=2><B>George Mason</B></FONT><B><BR><FONT color=#62a1d6 size=2>Technical Director</FONT></B> <BR><BR>
<TABLE border=0>
<TBODY>
<TR>
<TD vAlign=middle width=235><A href="http://www.xoomtalk.com/"><IMG border=0 src="msg://b7c8fa8f-95de-46dd-824a-81f90d119535/cid:part1.09070607.01070006@xoomtalk.com" width=225></A> </TD>
<TD><FONT style="FONT-FAMILY: Arial" color=#7b7979 size=2 face=Arial font=""><B>Tel:<BR>Mob:<BR>Fax:<BR>Web:</B> </FONT></TD>
<TD><FONT style="FONT-FAMILY: Arial" color=#62a1d6 size=2 face=Arial>+44 (0)1273 900090<BR>+44 (0)7966 403353<BR>+44 (0)1273 900091<BR><A style="TEXT-DECORATION: none; COLOR: #62a1d6" href="http://www.xoomtalk.com/">http://www.xoomtalk.com/</A> </FONT></TD></TR></TBODY></TABLE></FONT></DIV>
<DIV class=moz-cite-prefix>On 20/04/2016 18:00, Jonathan Yue wrote:<BR></DIV>
<BLOCKQUOTE class=cite cite=mid:emdb500ebb-e8e5-47f6-85ce-7433fb6108b8@asus-x553m type="cite">
<DIV>It's the ssh access that was hacked. I suddenly noticed an established ssh connection from Asia. since I disabled root login in ssh right after install, the hacker must somehow have got my login password. in a haste, I reverted the VM to a previous snapshot, so I can't analyze how hacking happened now.</DIV></BLOCKQUOTE><BR></BLOCKQUOTE></DIV></BODY></HTML>