Accessing IP restricted server from dynamic IP

Question

Our servers (all CentOS) are all restricted by IP but often i am out and about and stuck on a dynamic IP address. Using a DynDNS widget I have set this dynamic IP to always sync with a DynDNS hostname but how should i go about making this resolve to an IP in hosts.allow. For the moment i've written a cron script that runs every few minutes and checks the IP assigned to that hostname and writes the dynamic IP to hosts.allow but i'm not too keen on that as a solution. Is there a more elegant way i could be doing this?

Thanks.

Answer 1

The bellow script would ping your dynamic address and grab the ip only and then compare against the ip stored in last_ip.txt, if they are different the ip in hosts.allow will be removed and replaced with the new ip aswell as the ip in last_ip.txt.

You can then set this code on your crontab to run every 5 minutes or 10 or whatever you seem fit.

It is not as complex and might solve your problem...

#!/bin/bash

DYN_IP="www.google.com.br"
CMD=$(ping -c1 $DYN_IP | head -1 | awk -F' ' '{ print $3}' | sed 's/(\|)//g')
FILE="./last_ip.txt"
NEW_IP=$CMD

if [ -e $FILE ]; then
        OLD_IP=$(cat $FILE)
else
        OLD_IP="0"
fi

if [ $OLD_IP != $NEW_IP ]; then
        echo $NEW_IP > last_ip.txt
        sed -i "/^sshd: $OLD_IP/d" /etc/hosts.allow
        echo "sshd: $NEW_IP" >> /etc/hosts.allow
        echo "Allow ip changed to $NEW_IP"
fi

Answer 2

My current solution for this is webknocking where I first make a request to a special web page (optionally with my user/pass) that opens up the SSH gates for the IP that I request from. This is how I ssh into some of my servers from my phone. This keeps the extra software involved to a minimum so I could sit down at some cafe computer and authorize it for standard ssh access in a few seconds, but keeps the intruders from even being able to play with my ssh port. A drawback of any knocking solution is the extra point of failure. My safety net is a few hard coded IP's that are allowed access and if something goes wrong with the knocking scripts or web server that handles them, I just have to use one of the other machines that has permanent access to get into and fix the broken box.

Alternatively some dynamic ip systems have "hooks" or "callbacks" that can be used to get an automated notification of IP address changes. This could be via email or an http request that could be used as a "knock". Alternitavly you could script this on the local end so that whenever your network scripts run or local IP changes, you automatically fire off some kind of knock or trigger that forces and update of dynamic ip access list.

Answer 3

I can understand your concern about 3rd parties playing with an open SSH port. I have solved this in a different manner. On my private server, the SSH port is open to everybody, but it is monitored by fail2ban, a smart little package available for debian (and probably most other distros, too). As soon as somebody fails to log in after 3 attempts from the same IP address, that address gets blocked in the firewall for several days.

Ever since I installed this, I had peace and quiet on my server. And I can still log in (using my key from a USB stick) from anywhere in the world.

If you are the only one logging in to that server, you could also do a simple port forward in the firewall or run sshd on a different port.

Answer 4

I'd suggest port knocking as an alternative, alternatively rent a ssh account on a 3rd party server and SSH from there.

Answer 5

I would approach this from a different way. Rather than having your servers each maintaining a list of whitelisted IPs, I would configure them all to only allow ssh from "internal" IPs. Then setup a separate gateway/landingpad host that you can VPN in to. Now, you can bounce through that box to reach the rest of the servers securely.

This limits your attack surface to a single box, instead of all of your boxes. Additionally, many/most VPN solutions allow you to enhance the security requirements for a connection, using certificates, two factor authentication, and other things along with (or instead of) simple passwords. All in all, this will give you greater security, greater flexibility, and much better maintainability.

There are a number of VPN options available (I'm a big fan of OpenVPN, myself) that you can use to properly setup a secure access point for your devices. Many of them are relatively easy to setup, and for a small setup like this, they require minimal resources.

Answer 6

ConfigServerFirewall has the functionality you desire. Once installed, you can check out this forum post for a good explanation.

Answer 7

My solution is to block all ssh-access in hosts.deny with sshd: ALL To allow the access from servers with a special (dynamic) domain I created a skript that turns a list of allowed domains in a list with IPs. This IP-list is included into the hosts.allow by adding following line

file: /etc/hosts.allow

sshd: /etc/ssh_dyn_allow/hosts_sshd.allow

The Source of the script looks like this:

file: /etc/ssh_dyn_allow/renew_allowed_ip_list.sh

#!/bin/bash

SCRIPT=$(readlink -f "$0")
WORKDIR=$(dirname "$SCRIPT") 

ALLOWFILE=$WORKDIR/hosts_sshd.allow
DOMAINFILE=$WORKDIR/allowed_domain.list

DOMAINS=$(cat $DOMAINFILE |grep -v "^#")

echo "# automatic generated : $(date)" > $ALLOWFILE
for DOMAIN in $DOMAINS
  do
    echo "" 
    IP=$(dig $DOMAIN A | grep "^$DOMAIN" | sed -e 's/\s\s*/ /g' | cut -d " " -f5)
    echo "# $DOMAIN"
    echo $IP
    echo
  done  >> $ALLOWFILE

The script is executed with a cronjob each 15 minutes.

The file with the allowed domains is text file with one domain per line looks like this

file: /etc/ssh_dyn_allow/allowed_domain.list

# domainlist
# one domain per line
user1.ddnss.org
user2.ddnss.org
# fired_user.ddnss.org

# our other servers
web1.example.com
web2.example.com

Advantages:

• more than one (dynamic) domain can be handled (maybe for a colleague or other servers )
• the original hosts.allow cannot be destroyed by an erroneous script manipulating the file.