1

Are there any security risks when creating a user(s) with no shell, and no special privileges (using fairly strong passwords)?

Reasons

  • To redirect the attackers attention from "real" users (e.g. real user "smr", fake user "admin")
  • Secure logging of attempts to break into the system
  • Better distinguishable from login attempts to real accounts

Additional: How to notify an admin of "too many" suspicious attempts / what best to do?

Improve this question
3
  • Could you please explain more about the question? I don't understand how someone can break into your system if they can't get a shell in the first place? It's like trying to break into www-data via SSH, no one does it.
    – 99Con
    Feb 1, 2018 at 11:53
  • @99Con looking for unauthorised attempted access. www-data tries to log into ssh all the time, when using automated scanners ...
    – schroeder ♦
    Feb 1, 2018 at 12:33
  • Oh, I understand, if you're looking for attempted access then why don't you just look at the SSH logs for your server? You should look at fail2ban.org/wiki/index.php/Main_Page, this has what you're looking for.
    – 99Con
    Feb 1, 2018 at 13:16

1 Answer 1

Reset to default
1

It looks to me like a level of obscurity. In order to protect your admin account, the recommended way is to have a strong password, or even better an asymetric key on SSH. You can in addition provide a honey pot login named admin, but it does not add a lot of security, nor avoid logs examinations for real logins. IMHO, it would be mainly interesting if you were studying the behaviour of attackers, because no normal login attemps should occur on the honeypot.

As usually for obscurity, nothing is wrong if you do not rely on it but only see it as an additional protection level.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .