Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A server I'm working on has blocked all unknown addresses from accessing port 22 (via a firewall). An IP address has to be added to the firewall first via a control panel (or command line) before it can access port 22.

Is that a really good security measure? Are there ways that port 22 can still be hacked/penetrated given this measure? It's a really inconvenient measure (my IP changes almost on daily basis and I will have to update it). I still have access to that control panel to be able to add my IP, is that a weak point?

How effective/secure is this measure?

share|improve this question
Having you're IP address change daily suggests this is a home environment which is off topic for us. – Iain Jun 16 '13 at 10:48
up vote 0 down vote accepted

It depends on what you have listening on port 22. Assuming it is just SSH, then this would be a way to keep the system quite secure. However, having port 22 open to all and just allowing authentication with SSH keypairs would also be very secure and a better trade-off.

share|improve this answer
+1 to @peter. Instead of blocking from unknown ip's to secure, instead disable password authetication completely and use ssh keys (PKI) . – Naai Sekar Jun 16 '13 at 16:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.