0

Just trying to see how many people would be in favor for opening a port on a router, like port 22 or something similar for ssh, to all outside WAN connections or just a set of specific WAN ip's for that service. This would be done in an attempt to reduce the service being hacked. The protocol is ssh, using, best practices for deploying ssh of course. It has come to my attention that it is best to block connections to that port and let only a handful of outside IP addresses be able to connect from the locations of the known users.

Is this overkill? I have usually opened up the port on a router for users as they need these services or have been requested to open the port for software/hardware vendors that need access to their locations. Am I being paranoid or is there a specific time/application where hardening it to that degree is necessary? Thanks.

2 Answers 2

2

Now, you very clearly state "router", but I'm thinking you mean "firewall"?

Ideally you only open what is necessary. The more explicit you are the better, but there is no problem in making broad rules. For instance, I usually create a rule permitting any host on the inside to use UDP/53 outbound so that any client inside can make an external DNS lookup. However in the case of allowing SSH inbound, you might consider separate or aggregate rules for each resource. That way in a debug situation you can see which rule is being matched by which traffic (or dropped for that matter). SSH in this case is a powerful protocol that can be used to tunnel traffic into your network. If it were compromised and you allowed just any IP address to connect you might get into some fun.

1
  • yes i do mean firewall and the firewall rules
    – dasko
    Dec 16, 2011 at 14:03
0

I almost always open ports to as few people as possible.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .