1

I'm new at server management, and wrote an IPTables script for firewall. I'm very concerned about the security of my server, and thus I'm wondering about something that I read often from people using firewalls, which is limiting the source of the SSH connection that comes to the server.

The problem with this is that my server is a remote one that I rented, and as a person who connects to the server from my home and work, I have no reason to believe that my home and work IPs are gonna remain the same for ever. So, if I limit the source of SSH to my server, then what if my IP at home changes? And what if I travel to some other country and want to access my server? I travel a lot.

It sounds like I miss something... so could you guys explain the efficient way to deal with this?

The question is: How can I limit the source of SSH connection without limiting my own access to my server?

Thank you for any efforts.

3 Answers 3

1

Iptables is not the correct tool for solving this problem because it is limited to filtering by simple parameters such as source or destination address, port, protocol, and similar.

You should set up SSH public key authentication as described in this Ubuntu documentation HowtTo, and then force PK authentication using this Linux.org HowTo.

You could augment this by blocking SSH from source IP addresses in countries to which you know that you do not plan to travel. However, a determined attacker would probably have attack points from almost any country, so this is of limited benefit.

1

As in @Jonathan Ben-Avraham's answer, the first thing to do is to disable password access and switch to public key only. Of course, that requires you to not lose the private key: save a backup copy someplace safe.

The second approach you should take is to limit the number of incoming SSH connections. Add an iptables rule along the lines of

    iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW \
         -m hashlimit --hashlimit-above 1/min --hashlimit-mode srcip \
         --hashlimit-name ssh --hashlimit-burst 5 -j REJECT

The idea is that you can (try to) log in five times, but then you're frozen out for a minute. This will not inconvenience an authorized user, but the cracker script which tries every password (or private key) that's floating around on the 'net, attempting to find a match, will be blocked quite effectively.

You might also want to add two-factor authentication. This link https://www.digitalocean.com/community/articles/how-to-protect-ssh-with-two-factor-authentication describes the process rather well; basically you install the libpam-google-authenticator package, add auth required pam_google_authenticator.so to /etc/pam.d/sshd, install the Google Authenticator or androidtoken app on your phone, run google-authenticator on your server to set it all up, and restart the ssh service. (This is actually generic TOTP (RFC 6238) and not associated with Google, nor does it talk to them AFAIK.)

3
  • The iptables command doesn't work... I tried to 10 failed retries and it still allows me to connect... Jan 26, 2014 at 0:30
  • Works for me. Are you sure you're not using IPv6 to connect to that host? Jan 26, 2014 at 6:48
  • No I'm not... don't worry though, I found an alternative online. Thank you for the idea :) Jan 26, 2014 at 8:46
0

If you can't limit the scope of the source address that need to connect to your ssh server take a look at the following link. Poet knocking will basically allow you to dynamically open ports based on a sequence of packet the client sends (wikipedia will tell you more)

So the port remains close unless you knock at your firewall's door with the right code.

http://www.portknocking.org

IMHO its not what I would call an elegant solution and requires a client but that seems to match your needs.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .