Some Linux security questions 2264

On Mon, 31 Jul 2006 01:49:30 -0700, composlinuxmisc

sshd is the ssh-scp server. The "d" at the end says it's a daemon, it runs in the background and awaits for incomming requests from ssh or scp clients. Of course, sshd is run as root.

It's idle most of the time, so it doesn't take up much cpu, BUT, it does take up significant cpu power when a file is being transfered using scp.

To see exactly what daemons (servers) you have running on a machine, run as root

netstat -tupan

It will show you which port each server is listening on, and any established connections (and of course, where they are coming from), as well as connections waiting be closed.

To allow in the firewall ssh-scp connections from a certain machine, you do this:

sbin-iptables -A INPUT -s xx.yy.zz.ww-255.255.255.0 -p tcp -m tcp --dport 22 -j ACCEPT

(all in one line).

When you are satisfied with the new set of rules, you replace your oldetc-sysconfig-iptables (on a RH-Fedora system) with iptables.new.

Oh, and one last suggestion, to avoid annoying brute force probes on port 22 (the default sshd port), you can run sshd on another port (e.g. your birthday), by specifying it in etc-ssh-sshdconfig (then restart sshd). Then, only clients who know can connect to your ssh server, e.g. like so:

Of course, you would have to open port 23456 in iptables rather than the default 22.