Re: Continuous brute force attempt from own server !!! (OT question)

[Joel Rees <joel.rees@gmail.com>]

On Sun, Jul 28, 2013 at 10:12 PM, Henrique de Moraes Holschuh <hmh@debian.org> wrote:

On Sat, 27 Jul 2013, Paul E Condon wrote:
> I intended the question to be answered in the context of the post by
> Henrique de Moraes Holschuh, where 'across security domains' is
> considered less desirable than 'across hosts'. I know what hosts are
> when writing computer stuff, but, come to think about it what does it
> mean to rotate keys? Is the idea that a particular key string is to be

Switching to a new one and disposing of the older one is, for whatever
reason, usually called "rotating the keys".

Probably because of perceived similarities to rotating logs?

 

> reused on some host after it has been removed from service on some
> other host? I had thought that it was best to never use a retired key
> string again - but security is tricky - maybe there might be some

You're correct.  It is best to dispose of old keys, and never reuse them.

> point in using old strings as the keys on some (unmentioned) honey pot
> servers.

You could do that, but there might be risks associated with that (or not).

Actually, if you are running a network which needs to assume regular penetration (such as the banking internets and banks' intranets), honeypots of various kinds should be part of the network. Tripwire techniques. And the old keys folded into certain honeypots (flypaper servers), which would flag their use as indicating a potential source of privilege leak.

But you have to be very careful, because you are not putting the keys out to be discovered.

 

--
Joel Rees