4

I have several Linux servers without hardening the SSH:

  1. Allow root logins

  2. Use same password for all the servers

  3. Use default ssh port 22

But I have setup iptables to allow only my own IP to SSH to the server. Will this mitigate the above insecure practice?

Improve this question
4
  • 5
    Security is a matter of layers, so adding more security is not really a bad thing in this case.
    – gparent
    May 24, 2012 at 17:21
  • By the way, you can also use hosts_acccess to allow only your IP address. Just add sshd: IP_addr to /etc/hosts.allow and sshd: ALL to /etc/hosts.deny.
    – Cristian Ciupitu
    May 24, 2012 at 18:38
  • 1
    @CristianCiupitu See also serverfault.com/a/391453/3139 -> you can do it right in the sshd_config file.
    – Jeff Ferland
    May 24, 2012 at 18:42
  • If you only log in from one IP, why do you even HAVE password authentication? Just switch to key only and live happily ever after. The only time you really need pwd logins is when you have to be able to login from anywhere and don't always know beforehand where that "anywhere" could be.
    – TC1
    May 24, 2012 at 20:45

4 Answers 4

Reset to default
4

  1. Allow root logins

  2. Use same password for all the servers

  3. Use default ssh port 22

Changing each of the above is a strategy of risk mitigation. Changing all of those things doesn't make you safe. Leaving isn't dangerous by nature of itself. It does increase risk, but you might appreciate the convenience more than the risk.

For full TCP exchanges like are required with SSH, controlling the IP access range is reasonably effective against anybody who isn't a part of your network (same layer 2 branch or controlling upstream routing).

You do run the risk where one server compromise could expose the password for all, but you've limited where one can use the password from.

... but if the convenience is worth it, you feel ok, and these aren't subject to holding somebody else's important data, go for it. Just know why one would make those changes and what you're giving up for the convenience.

Improve this answer
1
  • I leave those as default for convenience since there's firewall to protect it. As baumgart said, we never know what could happen. I will start adding more secure layers. Thanks.
    – garconcn
    May 24, 2012 at 17:40
4

The answer is always yes. You never know what could happen.

Improve this answer
3

If it were me, I'd:

  • lockdown ssh
  • set up private/public key logins for a normal user to automate the login
  • su - once I logged in

Because it just isn't worth the worry

(This has the added benefit of allowing access from anywhere you have putty and your ssh key)

Improve this answer
0

IP Addresses can be spoofed. Lock your SSH down.

Improve this answer
2
  • 6
    Spoofing an IP for SSH is like putting someone else's package as the "delivery address" on Amazon.com. Usually not very useful.
    – ceejayoz
    May 24, 2012 at 17:29
  • You are correct for SSH and spoofing, I was more relating to iptables and IP spoofing, which is possible if configured incorrectly.
    – Joe
    May 24, 2012 at 17:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .