Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm new to the sysadmin/IT side of things, so I apologize if this may seem straightforward. I tried searching, but since SSH is such a broad field I didn't know what keywords or terminology to specifically use.

I'm going to be doing some traveling soon and I need to SSH into my EC2 Ubuntu server. Currently I have a static IP at home and UFW set up to restrict IP access for port 22. As far as the SSH itself goes, I use a key pair to log in.

Is there any way I can somehow get a static IP, or use some kind of VPN and then SSH into my server to still keep port 22 secured? Obviously I'm not the first person to travel while having to SSH into a server so there's got to be a solution.

As I stated, I currently keep port 22 access allowed only to my IP. Would it be too risky to open port 22 to all traffic? I use a key pair for SSH, not a username/password.

share|improve this question

5 Answers 5

up vote 4 down vote accepted

Keeping port 22 open is no less secure than keeping port 80 open on your web server as long as you are using public key authentication or secure user passwords. Many security practices are unfounded myths. It's unlikely that severe exploits exist in sshd.

Why is the VPN server's port suddenly more secure than the SSH port? Just verify your SSH public key each time you connect to prevent MITM attacks.

share|improve this answer
    
So, is that a "go for it" as far as opening port 22 goes? –  user3258348 Feb 12 at 8:41
    
Yes. Any tested server that is designed for public access should be used that way. –  Locutus Feb 12 at 9:59

Requiring a VPN for SSH is certainly more secure; the usual way of doing that is to establish a management network (to which your servers have a secondary connection) and provide VPN access to it. Have all the infrastructure listen for management traffic only on that network. Then, as required, VPN in and manage.

If you have only one server this is probably overkill. It should be enough to use strong public keys and ensure that only users who actually have shell accounts are allowed to authenticate. Disabling password authentication for SSH in this case is not a bad idea. To do that, edit /etc/ssh/sshd_config and set PasswordAuthentication no. If you are only using public key authentication, also be sure to disable PAM with UsePAM no, as PAM can authenticate users with passwords even when you have disabled password authentication in sshd.

share|improve this answer
    
Thanks for your reply. Currently I just have a key with no password. I only allow access to port 22 from my IP. If I disable it and allow anyone access to port 22, are the chances high of someone being able to hack in? Basically, I guess I'm asking if it's OK for me to disable the port 22 IP restriction while I'm traveling and continue to log in via key pair? –  user3258348 Feb 12 at 6:47
    
They would need the key, or to find a user who is allowed to use a password (unless that is completely disabled as I recommend). Such a configuration is pretty secure. It is approximately as secure as a VPN. –  Falcon Momot Feb 12 at 10:43

First some general security tips:

  • Use Key logins - you are good on that front
  • use big keys - e.g. generate a 4k rsa key (probably the current one is 1k or 2k
  • use strong password for the key - you should do that. If i can get my hands on your unprotected paswordless key .. everything is moot
  • move ssh to higher port - ex. 12322 - this will help with probing for services a little. And do not forget to open the port in the security group
  • monitor what is happening with your server - fail2ban is a wonderful tool
  • disable password logins (there are instructions in the other replies)
  • implement AllowUsers/AllowGroups to let only specific users (and root is not one of them) - coupled with aggressive fail2ban config this is prety much a killer.

Specifically for your question there are tools known as PortKnock-ers

Basically you do something (like trying to connect to several different ports in short time) and a port magically opens in the iptables.

Some reading on that topic:

NOTE: I do not have experience with portknocking and do not really recommend it as it can interfere with normal operations. Big secured key and ssh on non-standard port are prety much enough.

share|improve this answer
    
So you're suggesting to use a 4k key and a password to go along with that key? –  user3258348 Feb 12 at 17:34
    
Yes exactly. The fact that the key is passwordless does not improve your security a bit. It can be stollen, lost, found, seen and missused –  zeridon Feb 14 at 8:05

You can setup an OpenVPN server on your machine and access your instance through that. Check the below link for setting up the OpenVPN Server.

http://www.whiteboardcoder.com/2012/12/amazon-aws-vpc-setting-up-openvpn-server.html

You need to change your security group a little. Currently, you have a static IP as allowed host for inbound connections. Make it an IP range which matches the IP address range of OpenVPN Server's dynamic ip address (The one you specify in VPN Settings in the above link).

OpenVPN server will be accessible to all, but that connection is encrypted (https) and protected by your OpenVPN profile key and your account password.

share|improve this answer
    
I'm not using a VPC instance, unfortunately. I was planning on launching one soon and replacing the current one. –  user3258348 Feb 12 at 7:05

I'd setup a dynamic dns account like no-ip or dynds on your laptop, then you can add that dyn hostname to /etc/hosts.allow and block everything else on /etc/hosts/deny.

That way you have your linux to only allow that dynamic host, also you might need to add your local subnet segment to the /etc/hosts.allow file.

cheers...

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.