Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'd like to hear some opinions on implementing a SSH jump box as I am currently documenting on this. I am searching for a very lightweight linux OS through which I can access my internal network. Only this server will have port 22 unfirewalled so I can login from everywhere I am.

      SSH box
    /    |    \
server1 - server2 - server3

Now from the security perspective, how should one proceed to keep this host uncompromised? I was thinking to automatically reinstall the OS every x hours, but this might be a pain to set up - if even possible.

share|improve this question

1 Answer 1

I use jump boxes all the time, the easiest option is is a virtual machine in my opinion. It's such a medial task there is no need for a dedicated machine (unless you have hundreads of remote technicians?). Have a VM that runs SSH and PPTPD or OpenVPN.

As you say, only allow SSH for example in via itpables then use all your usual SSH best practices to keep it safe; don't allow root access, use only non-dictionary passwords or keys, if you come from static IPs outside, only allows those in, use fail2ban or iptables rules to ban IPs for 15 minutes that get 5 incorrect logins, blah blah blah (there is plenty of info on hardening SSH out there).

I don't think there is a need to re-install the OS every X hours. This is security through obscurity. If the machine is "broken into", how will you know if you just roll it back again a few hours later? Also, the security flaw exploited will still be there, so it will be re-exploited. Many people around the world have sshd open to the public on servers, that seems like an unnecessary step to me. Perhaps move it to a different port, this will remove all the automated attacks which just fill up your logs and frankly, annoy me, but obviously any determined human not machine, will find the alternate port in a jiffy (again this is more security through obscurity, I just do it so I don't have such massive logs).

share|improve this answer
    
Indeed, no need to use a physical dedicated server for SSH. Will use a VM for it. Although a VPN tunnel is an added security layer, I think it may also obstruct me from logging in from my mobile phone for example. I am currently allowing SSH from certain hosts only, but also want general access when I am away from those hosts. –  w00t Jan 30 '12 at 10:17
    
Depends on what phone you have, I use android tablets and mobiles, they have PPTP support natively out of the box, and if you root them you can get good OpenVPN support, although PPTP normally does the job. –  jwbensley Jan 30 '12 at 10:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.