Intresting Article At Ars

http://arstechnica.com/news.ars/post/20080...tacks-rise.html

While the title is sort of alarmist, it raises some interesting issues.

Is there a way to change the user "root" to something else? I think that would cut down on the effectiveness of brute force attacks on ssh by a fair margin. Unless one changed it to "Administrator" or something silly like that.

As your linked article says:

If you've got an SSH server that you want to secure from brute-force attack, Owens and Matthews recommend:

· all passwords should be strong, usernames should be non-obvious

· SSH logins for the root account should be disabled

· run the SSH server on a non-standard high port ("security through obscurity" tactic)

· use software capable of parsing log files and noting multiple failed login attempts

These steps, taken in aggregate, should be sufficient to protect an SSH server, even if the number of attacks continues to rise.