Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have several Linux servers without hardening the SSH:

  1. Allow root logins

  2. Use same password for all the servers

  3. Use default ssh port 22

But I have setup iptables to allow only my own IP to SSH to the server. Will this mitigate the above insecure practice?

share|improve this question
5  
Security is a matter of layers, so adding more security is not really a bad thing in this case. –  gparent May 24 '12 at 17:21
    
By the way, you can also use hosts_acccess to allow only your IP address. Just add sshd: IP_addr to /etc/hosts.allow and sshd: ALL to /etc/hosts.deny. –  Cristian Ciupitu May 24 '12 at 18:38
1  
@CristianCiupitu See also serverfault.com/a/391453/3139 -> you can do it right in the sshd_config file. –  Jeff Ferland May 24 '12 at 18:42
    
If you only log in from one IP, why do you even HAVE password authentication? Just switch to key only and live happily ever after. The only time you really need pwd logins is when you have to be able to login from anywhere and don't always know beforehand where that "anywhere" could be. –  TC1 May 24 '12 at 20:45

4 Answers 4

up vote 4 down vote accepted
  1. Allow root logins

  2. Use same password for all the servers

  3. Use default ssh port 22

Changing each of the above is a strategy of risk mitigation. Changing all of those things doesn't make you safe. Leaving isn't dangerous by nature of itself. It does increase risk, but you might appreciate the convenience more than the risk.

For full TCP exchanges like are required with SSH, controlling the IP access range is reasonably effective against anybody who isn't a part of your network (same layer 2 branch or controlling upstream routing).

You do run the risk where one server compromise could expose the password for all, but you've limited where one can use the password from.

... but if the convenience is worth it, you feel ok, and these aren't subject to holding somebody else's important data, go for it. Just know why one would make those changes and what you're giving up for the convenience.

share|improve this answer
    
I leave those as default for convenience since there's firewall to protect it. As baumgart said, we never know what could happen. I will start adding more secure layers. Thanks. –  garconcn May 24 '12 at 17:40

The answer is always yes. You never know what could happen.

share|improve this answer

If it were me, I'd:

  • lockdown ssh
  • set up private/public key logins for a normal user to automate the login
  • su - once I logged in

Because it just isn't worth the worry

(This has the added benefit of allowing access from anywhere you have putty and your ssh key)

share|improve this answer

IP Addresses can be spoofed. Lock your SSH down.

share|improve this answer
6  
Spoofing an IP for SSH is like putting someone else's package as the "delivery address" on Amazon.com. Usually not very useful. –  ceejayoz May 24 '12 at 17:29
    
You are correct for SSH and spoofing, I was more relating to iptables and IP spoofing, which is possible if configured incorrectly. –  Joe May 24 '12 at 17:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.