1/ Linux #Hardening and #ThreatHunting The screenshot below is from Microsoft [1] - using XorDdos as an example, we can learn a lot about Linux forensics and hardening. 🧵 #CyberSecurity
10
153
5
480
2/ XorDdos bruteforces (root) access via SSH. Learning: Prevent logging in via SSH with passwords (use priv/pub keys instead). Within the SSH config (/etc/ssh/sshd_config), modify at least the following two lines: PermitRootLogin no PasswordAuthentication no
3
4
1
17
Replying to @malmoeb @Shpantzer
Not sufficient. “UsePAM yes” effectively overrides “PasswordAuthentication no” and “UsePAM no” is a bad idea. You need to disable password auth in your PAM stack too.

Aug 9, 2022 · 3:59 PM UTC
2