0

My server has been hacked a few days ago and now I decide to ban root user remote login. Is there a way that an attacker can scan my own added user name? (As far as know the answer is NO?). If so, I don't have to set a too strong password for the new user. I mean, it would be far more difficult to guess my custom user name than "root + password".

Rick
  • 180
  • what about cat /etc/passwd? – g_p Oct 16 '18 at 14:11
  • 2
    I believe he means from outside the internet ... – pLumo Oct 16 '18 at 14:14
  • @RoVo Yes, I mean from outside. – Rick Oct 16 '18 at 14:23
  • 2
    If your server was "hacked a few days ago", then it's too late. The intruder could have installed all kinds of nifty backdoors, regardless of how clever your username is. Take your system offline, nuke the disk, do a full clean reinstall from scratch, then restore your data from backups. Of course, if you enabled root login (bad idea), then it's also likely you don't have backups..in which case this will have been a hard lesson for you about both. – user535733 Oct 16 '18 at 15:56
  • @user535733 I reinstalled the whole system on the control panel. I think normally that would be enough? I mean, I am not specifically targeted. – Rick Oct 16 '18 at 16:36

1 Answers1

6

No, it is not possible to see user names from outside the computer other than brute-forcing it.

In general, disabling remote root login is a good idea. Using public key authentication instead of password login is another one.

If you want to keep password login, you can install fail2ban for better security. This will ban IP addresses based on unsuccessful login tries.

For a minimal working setup of fail2ban for securing sshd, you need just 3 simple steps:

# Install fail2ban
sudo apt update && sudo apt install fail2ban
# Enable fail2ban for sshd
printf '%s\n%s\n' "[sshd]" "enable = true" | sudo tee -a /etc/fail2ban/jail.local
# Restart fail2ban
sudo service fail2ban restart

This will enable the default 600 seconds ban after 3 failed login attempts within 600 seconds.

pLumo
  • 26,947
  • Yes, I get to know fail2ban from an another post just now and am reading the documentation But it seems to be quite complicated to set it up. T_T. – Rick Oct 16 '18 at 14:26
  • 1
    Added a very simple 3-step installation guide of fail2ban. – pLumo Oct 16 '18 at 15:02