Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm currently installing CSF (http://www.configserver.com/) for my Ubuntu server and in CSf you're able to specify the ports you want everyone to be able to access, and if your IP is in the allowed list you can still access any port even if it isn't on the port list. I was wondering if it'd be stupid to block the SSH port from everyone and only allow access from the allowed list of IPs. Is it a good idea, or not?

share|improve this question

migrated from stackoverflow.com Jul 22 '12 at 15:27

This question came from our site for professional and enthusiast programmers.

2 Answers 2

Expanding on what @piotrek wrote: It depends.

If you only need access from the same location, and that location as a static IP that won't change, then you should be okay. But if you ever need access from outside or if you static IP changes, then you would need to go into the server and change it otherwise you could potentially lock yourself out.

SSH is a huge target, but SSH itself is secure. As long as your users use strong password, or you only allow access via ssh-keys. The chances of it becoming hacked are slim.

IMO, a better way of protecting your SSH server is to use tools like Fail2ban, or DenyHosts. Or based on ConfigServer Security & Firewall,

Block traffic on the DShield Block List and the Spamhaus DROP List

share|improve this answer
    
Another interesting way to block access to a certain port is to use port knocking - serverfault.com/questions/86969/… –  Ryan Gibbons Jul 22 '12 at 15:59
    
Until, of course, you wind up on the DShield Block List of the Spamhaus DROP list because someone got your server to send spam, meaning you can't get in to undo it. :-p –  ceejayoz Jul 22 '12 at 17:55
    
@ceejayoz Those use the IP of the connecting machine to block, not your server. So if your local machine was hacked, or you ended up with a bad IP during your lease then it could block. But not your server –  Ryan Gibbons Jul 23 '12 at 20:28

depends on your situation. if ssh is not required to be accesses from all over the world then sure, do it. it costs you nothing and certainly complicates an attacker's life

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.