SSH brute force attacks

[user641]

I've updated the wiki entry - please report back if it's still confusing or you find anything wrong.

wow, thanks so much!!! now it's much clearer. I will try again later.

[bitnick]

Hello,

If I setup a SSH connection simply using the password, with a numerical passwordof 8 digits it will be very easily crackable right? If I let port 22 open on the pine phone, and I connect to another wifi than my lan, or to 4g, will my device be vulnerable to brute force attacks?

Your device will be vulnerable in theory, but the risk should be very low if you use a random eight-digit number. Eight digits, that's 100 million combinations, and sshd by default allows sex auth tries before it enforces a login grace time of two minutes. So six tries every two minutes. That's 63 years to try all combinations... and that's if the intruder already knows your username.

I would be more worried about bugs/vulnerabilities in whatever service(s) I run on the phone.

[user641]

Hello,

If I setup a SSH connection simply using the password, with a numerical passwordof 8 digits it will be very easily crackable right? If I let port 22 open on the pine phone, and I connect to another wifi than my lan, or to 4g, will my device be vulnerable to brute force attacks?

Your device will be vulnerable in theory, but the risk should be very low if you use a random eight-digit number. Eight digits, that's 100 million combinations, and sshd by default allows sex auth tries before it enforces a login grace time of two minutes. So six tries every two minutes. That's 63 years to try all combinations... and that's if the intruder already knows your username.

I would be more worried about bugs/vulnerabilities in whatever service(s) I run on the phone.

Interesting math perspective!

[RTP]

(as earlier reply mentioned) Mobian Wiki is a great resource.

Since you asked about pin numbers for ssh, a while back I happened to write on securing SSH on Pinephone + it starts with cracking default pin using Hydra - just mirrored to wordpress in case it helps.
(Part I also includes the "most popular pin numbers list" - be sure your pin is not on this list).

Part I Cracking default pin demo + sshd_config settings to mitigate: https://politictech.wordpress.com/2022/0...word-demo/
Part II: Add Key Auth + Learn to check SSH fingerprints: https://politictech.wordpress.com/2022/0...void-mitm/