Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

it would be a good idea to not have webmin running all the time... just start it via ssh when I need it...

so, I just stop webmin,and leaving SSH always running... when I need to access webmin, I start it through SSH.

but there are lots of people from many country trying to bruteforce my SSH. I can reduce bruteforce using iptables.

but because Im feeling still not safe (about 3 months ago), so I stop SSH and leaving webmin always running through custom port. I just start SSH through webmin when I need. and the result, no more bruteforce on SSH, and no bruteforce on webmin (maybe because the attacker dont know my webmin custom port)

but I think this is still not really safe. and I cannot restrict access to some IP because I use random IP. If I stop both SSH and webmin, I will lost access to my server.

Anyone know the better way dealing with this?

share|improve this question
add comment

3 Answers

A few ideas:

  • I would trust ssh's ability to withstand attacks more than WebAdmin. Run ssh on a different port.
  • Run shh all the time, but switch to key-based authentication. Rather than typing in a password that is sent to the ssh server, you have a file on your ssh client or maybe a USB key. You can password protect this key, but this key is never sent over the network. Brute force password attempts against the server are useless as the ssh server doesn't want a password for authentication any more.
  • Use Port Knocking. The idea is that your server only allows connections after the client has tried connecting to a specific set of ports in a specific sequence. I've never used it.

Of all the things I suggested, switching to the ssh server to key-based authentication and carrying the key on your laptop or usb stick is probably the most secure. However, if you lose the key file, you're out of luck.

share|improve this answer
1  
Port knocking aside, the brute-force scanners that seek out any and all servers running SSH are shut down hard just by running SSH on a non-standard port. They don't usually take the time to look for SSH instances on ports other than 22. If you need to run on 22, fail2ban is great, too, especially if you make it a little stricter than the defaults. (I have it lock out an IP for hours after one failed attempt against certain usernames -- "root", "oracle", "admin", "test", etc.) –  Nicholas Knight Apr 2 '10 at 13:39
    
+1 on all of that. Also consider denying root from logging in through ssh and use sudo instead. –  kaerast Apr 2 '10 at 16:55
    
@Nicholas Knight: Thanks for the pointer to fail2ban. I love serverfault. I answer a questions and still learn something new. –  kbyrd Apr 2 '10 at 18:49
add comment

I run sshd on a non-standard port - and that has all but eliminated brute-force attacks.

I've never seen issues with Webmin, or ssh, personally, but if you're concerned, you can run ssh on a non-standard port (such as 10101), and then only start webmin just before you need it via an ssh call such as:

ssh user@host -p 10101 'service webmin start'

Then, once done with Webmin:

ssh user@host -p 10101 'service webmin stop'
share|improve this answer
add comment

This isn't necessary. I manage servers which run SSH and webmin 24/7 and have for years and have never had an issue. Just make sure you have strong passwords.

If you are concerned about Webmin, then firewall it off and only access it though an SSH tunnel.

However turning SSH on and off is absolutly not necessary. Everyone gets SSH bruteforce attempts -- just make sure you have a very strong password. If you're sill very concerned, disable SSH password authentication and use SSH public key authentication only.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.