Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'd like to have my own distant server, and to connect to it through SSH.

But I'd like to do it through many PCs (i.e. many different IPs), do you have any advice / secure solution for doing this?

share|improve this question
2  
Is it security, that you want or is it anonymity? Anonymity requires security, of course, but what you want to do sounds more like anonymity than mere security to me. –  juwi Feb 6 '12 at 17:13
    
Are you trying to connect to Z from A (or B or C) where Z has a dynamic IP address or are you attempting to connect to Z from A via (B,C,D etc) ? –  Iain Feb 6 '12 at 17:52
add comment

4 Answers

If you're using SSH, that's what makes it secure. The fact that your client machines have different (and dynamic) addresses doesn't make a lick of difference.

share|improve this answer
add comment

Consider a non-standard port, use something like port knocking if you can, and only use public key authentication. If you do have password auth enabled, install fail2ban.

share|improve this answer
add comment

What are you trying to achieve? How much control are you going to have over those machines that will be ssh clients?

Ideally, you will use key-based authentication, where you would have your ssh private key on the machine when connecting to the server.

If that isn't possible, you should make sure you have a good password.

On the server, restrict the users who can ssh into the box. Exclude users such as root, etc., from being able to ssh. This is the AllowGroups or AllowUsers setting in /etc/ssh/sshd_config.

share|improve this answer
add comment

Disable root login. Set up your keys and disable password login, install fail2ban or denyhosts.

That appears to be sufficient from what I have seen.

You can take it further. An alternative is to have an intermediate server or two elsewhere that aren't mission critical and ssh through one of them, then you can limit access to ssh on your important server from only those IP addresses in iptables.

Moving sshd to a different port may sound like security through obscurity and you may find articles saying this is not effective. That may be the case if an attacker is targeting your server. In real life you see ssh attacks just hammering on port 22 moving across your servers. Moving to another port reduces the noise in the log files if nothing else.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.