Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

A number of years ago now, there were several remote exploits for OpenSSH which prompted many admins including myself to start filtering port 22 at the network perimeter, permitting only IP addresses of staff to use SSH. It was a common practice.

It made sense then, but does it make sense now?

I'm talking about the security and exploitability of the ssh daemon itself, I'm not worried about bots trying to brute force password logins. In my shop, ssh is already locked down; root logins are disabled, only public key auth is used.

Basically I'm asking if there are kiddies out there that have been sitting on OpenSSH zero-day for 9 years? A guy I work with assumes so and his logic is "because it's a server". I find his belief questionable.

share|improve this question
    
Like all security, it completely depends on what you are trying to protect. Do you have credit card data, health-care data. Do you have good backups, could you quickly repair things if you where compromised? Do you have other systems in place to limit the actual danger if someone is actually able to connect via SSH? –  Zoredache May 25 '11 at 22:59

2 Answers 2

I'd say it's still worth avoiding a large attack surface in the form of your SSH server.

Some things I do (varying between different machines) are:

  • iptable level connection rate limiting
  • run SSH on a different port
  • fail2ban
  • opie
  • no root logins
  • ssh keys only

Running ssh on a different port avoids a lot of the bots and scans, but is a little bit more work when connecting (but an entry in ~/.ssh/config helps). It won't stop a determined hacker, just bots etc

Something like fail2ban + iptables, or iptables connection rate limiting is likely worth doing. It's quite simple to set up, but will quickly slow down anyone repeatedly trying things, and shouldn't affect you.

No root logins / OPIE / ssh keys only should help for most, but not all zero days, and will help with lots of other situations too. It can make the setup of a new machine / new admin a bit longer, but what it offers should be worth it.

share|improve this answer

While there may not be (many) kiddies out there with those kind of exploits going on -- there are DEFINATELY zombie boxes with scripts that do it for them.

That being said -- there are still nasty hacks that can happen because of pin-holed IP addresses -- your security is only as strong as the remote machine/ip's security.

Look into Tunneling / VPN technologies at the very minimum. Also throw away passwords (authenticators and the like) if your really concerned about security.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.