[BlueOnyx:12269] Re: Kernel 0-day vulnerability + SSHd Spam Exploit (libkeyutils.so.1.9)

[Chris Gebhardt - VIRTBIZ Internet]

On 2/20/2013 8:17 AM, Michael Stauber wrote:
> ### A WHOLE LOT OF HELPFUL INFORMATION ###

Hi Michael & Dan,
Thanks for the research and sharing of the information.  I think that 
it's helpful.

What I have done for our hosting network is created an ACL at the 
gateway router that restricts access to port 22 to only a couple of our 
IPs (our office LAN and one remote system).   Note that works best when 
you've got a static IP that you access your server(s) from.

Any VIRTBIZ dedicated server or colocation customers that would like to 
discuss adding some similar restrictions at the gateway level, please 
touch base with me or Darryl off-list.  There are a couple of 
considerations that we'll want to cover before just rolling it in for you.

Blocking with an ACL at a routing level is one of a handful of 
techniques that can be leveraged effectively.  I don't present it as the 
"only" or "best" option, since the "best" option will be the one that 
works most cleanly and efficiently for your particular purposes and set 
of circumstances.   In the case of our hosting network, it seems to be a 
pretty sensible option.

-- 
Chris Gebhardt
VIRTBIZ Internet Services
Access, Web Hosting, Colocation, Dedicated
www.virtbiz.com | toll-free (866) 4 VIRTBIZ