2

I'm currently installing CSF (http://www.configserver.com/) for my Ubuntu server and in CSf you're able to specify the ports you want everyone to be able to access, and if your IP is in the allowed list you can still access any port even if it isn't on the port list. I was wondering if it'd be stupid to block the SSH port from everyone and only allow access from the allowed list of IPs. Is it a good idea, or not?

2 Answers 2

3

Expanding on what @piotrek wrote: It depends.

If you only need access from the same location, and that location as a static IP that won't change, then you should be okay. But if you ever need access from outside or if you static IP changes, then you would need to go into the server and change it otherwise you could potentially lock yourself out.

SSH is a huge target, but SSH itself is secure. As long as your users use strong password, or you only allow access via ssh-keys. The chances of it becoming hacked are slim.

IMO, a better way of protecting your SSH server is to use tools like Fail2ban, or DenyHosts. Or based on ConfigServer Security & Firewall,

Block traffic on the DShield Block List and the Spamhaus DROP List

3
  • Another interesting way to block access to a certain port is to use port knocking - serverfault.com/questions/86969/… Jul 22, 2012 at 15:59
  • Until, of course, you wind up on the DShield Block List of the Spamhaus DROP list because someone got your server to send spam, meaning you can't get in to undo it. :-p
    – ceejayoz
    Jul 22, 2012 at 17:55
  • @ceejayoz Those use the IP of the connecting machine to block, not your server. So if your local machine was hacked, or you ended up with a bad IP during your lease then it could block. But not your server Jul 23, 2012 at 20:28
0

depends on your situation. if ssh is not required to be accesses from all over the world then sure, do it. it costs you nothing and certainly complicates an attacker's life

You must log in to answer this question.