19

I'm looking for clarification on what I see as a potential problem with EC2 Security Groups.

I'm setting up a Security Group for connecting to linux instances. I've created "anywhere" rules for HTTP and HTTPS access.

For my SSH rule, the amazon tutorial says I should limit inbound access to my public IP address.

  1. What I don't get is how that's secure or workable if your public IP address is dynamic?

  2. My IP address is dynamic, so what happens when my ISP changes my public IP and I can no longer ssh into my instance?

Link to the setup guide I'm using: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/get-set-up-for-amazon-ec2.html (Step 7 of 'Create a Security Group' is what seems problematic to me)

6 Answers 6

8

What I don't get is how that's secure or workable if your public IP address is dynamic?

This solution could work if you find your IP doesn't change often, or if you only need access for a short time. It adds an extra layer of security as SSH isn't exposed to traffic outside of the CIDR you supply.

If a specific CIDR doesn't work, you could try on or more board CIDR ranges that your ISP is likely to use, this will still limit access from a large percentage of the Internet, and that's a win for security.

what happens when my ISP changes my public IP and I can no longer ssh into my instance?

You can login to the AWS Console, or use the CLI to update the Security Group rule on the fly.

You could write a script that interacts with the CLI directly. It could be as simple as something that checks for the Port 22 rule against your current IP and updates it if it's different. Of course running such a script might raise more security questions itself :)

Is an IP firewall the best way to secure SSH?

While it's nice to limit ssh traffic to only trusted IP sources where practical, the thing that makes ssh secure is the use of private keys and sensible configuration.

Key items to consider:

  • Add a passphrase to your SSH private key
  • Disable password auth to SSH
  • Disable root login to SSH
  • Audit all user accounts for SSH public keys

You could also do a few things to get rid of the 'noise' associated with brute force attacks:

  • Run ssh on a higher port
  • Use software like fail2ban which will dynamically log numerous failed attempt and block IP ranges for specified periods of time
0
6

It's fine to restrict access to your SSH server by IP address, but SSH doesn't rely on that for its security. If you disable password logins (PasswordAUthentication no) and use private key authentication only, no one can get in without your private key. It's safe.

So in other words, you don't have to worry about the firewall rules if you don't want to.

1
  • 1
    You do have to worry about a targeted attack on your local computer to grab the key file, but if you're not running something that deals with healthcare/credit-card/government data the chances of that are probably minimal.
    – ceejayoz
    Jun 29, 2015 at 21:20
4

There are couple of more recent solutions to this older question:

From inside AWS: How to Automatically Update Your Security Groups for Amazon CloudFront and AWS WAF by Using AWS Lambda

Remote update from the dynamic source (node.js script): aws-ec2-ssh-secgroup-update node script

Remote update from the dynamic source (Python script): Automatically add current public IP to Security Group to allow traffic on specific port

3

You can add a CIDR range to the security group that represents the superset of all IPs your ISP can allocate to you.

Either that, or use the AWS API to dynamically update your security group.

1

You can use aws_ipadd command to easily update and Manage AWS security group rules and whitelist your public ip with port whenever it's changed.

$ aws_ipadd my_project_ssh
 Your IP 10.10.1.14/32 and Port 22 is whitelisted successfully.

$ aws_ipadd my_project_ssh
 Modifying existing rule...
 Removing old whitelisted IP '10.10.1.14/32'.
 Whitelisting new IP '10.4.10.16/32'.
 Rule successfully updated!
0

You can use AWS CLI to dynamicaly add/remove access rules for SSH in your security group. There are authorize-security-group-ingress and revoke-security-group-ingress API methods available.

I've recently published a blog post about it in case you need a step-by-step explanation.

After setting up the correct security group and IAM users you can toggle your SSH access using the following bash scripts:

bin/open_ssh

#!/bin/sh

source ./bin/.authorize_aws

WHITELISTED_IP=$(curl https://ifconfig.me 2> /dev/null)

echo "Opening SSH for ${WHITELISTED_IP}"

aws ec2 autorize-security-group-ingress \
--group-name ephemeral-ec2-ssh-access \
--region us-west-1 --protocol tcp --port 22 \
--cidr "${WHITELISTED_IP}/32" 2> /dev/null

unset AWS_ACCESS_KEY_ID
unset AWS_SECRET_ACCESS_KEY

bin/close_ssh

#!/bin/sh

source ./bin/.authorize_aws

WHITELISTED_IP=$(curl https://ifconfig.me 2> /dev/null)

echo "Closing SSH for ${WHITELISTED_IP}"

aws ec2 revoke-security-group-ingress \
--group-name ephemeral-ec2-ssh-access \
--region us-west-1 --protocol tcp --port 22 \
--cidr "${WHITELISTED_IP}/32" 2> /dev/null

unset AWS_ACCESS_KEY_ID
unset AWS_SECRET_ACCESS_KEY
1
  • 1
    Please, always quote the most relevant part of an important link, in case the target site is unreachable or goes permanently offline. You can take a look at How do I write a good answer ?
    – Swisstone
    Apr 26, 2020 at 17:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .