0

Our production server hosts a small web system that runs on Apache and MySQL.

Today SSH and mysql access is open to all ips and only password protected. So we've decided that we need to improve security.

I'm thinking that we restrict SSH and mysql access to our server, so that only connections from our office is accepted.

We have a dynamic IP at our office today so we have to get a static one I think.

Sometimes however we need to access our server when we're out on the road. So I'm thinking that we get a stationary computer for the office that would be our DHCP server and SSH tunnel. So that we can connect to it and send all our traffic through it, so we get our office's IP.

Is this a good solution? Anything else I should do?

Improve this question

2 Answers 2

Reset to default
2

The best solution is to keep port 22 open to all but only allow key authentication. Then restrict Mysql to localhost and use a SSH tunnel whenever you want to connect to Mysql directly.

Improve this answer
6
  • 1
    well I would go so far as move ssh to a non standard port, and only allow key auth. The non standard port cuts down on the massive amount of log spam / auth attempts by bots looking for vulnerable servers on port 22. Another option would be to look into something like OPenVPN.
    – Doon
    Sep 30, 2013 at 11:10
  • When you say only allow key authentification, do you mean I should use that as well as a password? What if someone stole my laptop, wouldn't they get the key file and be able to access the server?
    – Andreas Larsson
    Sep 30, 2013 at 12:41
  • @AndreasLarsson The key file can be password-protected as well, so yes, it would be 2-factor authentication.
    – Nathan C
    Sep 30, 2013 at 14:01
  • @Doon that doesn't make any sense. If you have port 22 restricted to key only, that is protection enough from spammers. But really, only noobs move their key service to custom ports because it is not improve security AT ALL (they can do a port scan just as easily). AndreasLarsson: that is counteracted by adding a passphrase to your key.
    – Peter
    Oct 2, 2013 at 9:50
  • I never said it improved security. It doesn't protect against a dedicated attack where a person is actively looking to compromise your box, but against the tons of owned *nix boxes that go out and actively look for vulnerable / exploitable ssh servers, it cuts down on the amount of log entries as your server is harmlessly probed(the log spam I was referring to). Making login failures on a non-standard port worth more investigation, as they are less likely to be bots.
    – Doon
    Oct 2, 2013 at 11:05
1

Instead of restricting SSH to IP , why not to use Key base SSH authentication, and for mysql you can create a user with some password for specific database.

Improve this answer
2
  • Do you mean that I should use a key to authenticate (office server)<-->(production server) or that I should have a key for everyones personal computer here, so that everyone can access the production server from where ever? And what would happen if the server at our office crashed and we lost the key, would we be unable to access our production server??
    – Andreas Larsson
    Sep 30, 2013 at 13:23
  • @AndreasLarsson You can avoid this by backing up the private key on the server to a secure place.
    – Nathan C
    Sep 30, 2013 at 14:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .