<story><title>Fishing for Hackers: Analysis of a Linux Server Attack</title><url>http://draios.com/fishing-for-hackers/</url></story><parent_chain></parent_chain><comment><author>jwcrux</author><text>OP may also benefit from the use of an SSH honeypot. I use kippo (&lt;a href=&quot;https://code.google.com/p/kippo/&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;code.google.com&amp;#x2F;p&amp;#x2F;kippo&amp;#x2F;&lt;/a&gt;) with great success. It tracks all commands run, as well as keeps copies of all downloaded files.&lt;p&gt;In addition, it limits available commands to a certain predefined subset, allowing the host to prevent damage caused (e.g. a DoS attack in this case) by the system being compromised.</text></comment>
<story><title>Fishing for Hackers: Analysis of a Linux Server Attack</title><url>http://draios.com/fishing-for-hackers/</url></story><parent_chain></parent_chain><comment><author>fragmede</author><text>So a DO&amp;#x2F;Rackspace&amp;#x2F;AWS VPS with a guessable root password can expect to be cracked in ~4 hours?&lt;p&gt;That&amp;#x27;s terrible!&lt;p&gt;AFAIK, AWS defaults to ssh-key logins with password logins disabled. Can someone comment about Rackspace&amp;#x2F;DO?</text></comment>