2

I've got an EC2 instance running on an AWS VPC (free tier), on top of which I'm running a website.

I'm also using an RDS MySQL DB Instance for my database needs, and have set up security groups to allow the following:

EC2 Security Group - Inbound:

  • Allows access to all HTTP traffic via port 80
  • Allows access to SSH traffic from 2 IP adresses I usually sit in via port 22
  • Allows access to all MySQL Traffic via port 3306

EC2 Security Group - Outbound:

  • Allows access to all traffic from all ports

RDS Security Group - Inbound:

  • Allows access to MySQL Traffic from my EC2 security group over port 3306

RDS Security Group - Outbound:

  • Allows access to all traffic from all ports

Usually, when I sit outside of the 2 IPs I mentioned in the security groupt I create a new inbound rule in my default security group for the EC2 instance, which allows SSH access over port 22 from the IP in which I'm currently sitting.

Today, for some odd reason, I cannot connect over SSH to the EC2 Instance. I'm trying to from the public WiFi in the Cafe I'm sitting at. Tried various methods - PuTTY, Sublime SFTP, Filezilla. Nada.

I would love to know 2 things, really:

  1. What am I doing wrong? How to avoid this constant handling of security groups in AWS?
  2. What is the reason I'm not able to connect right now?

Important Note: The EC2 instance is up, and can be accessed over port 80 via HTTP - meaning I can go the URL of the site I set up, and everything is hunky-dory. Cleared cache - still loads perfectly.

Improve this question
7
  • Can you SSH into other hosts not on AWS? Maybe SSH in general is blocked.
    – Sven
    Dec 29, 2014 at 18:59
  • Hmmp. I'm not really using any other form of SSH.
    – Tom Granot
    Dec 29, 2014 at 19:00
  • OK - tried to SSH to openshells.net using PuTTY. No luck. Is it possible that I can't open a tunnel over public WiFi?
    – Tom Granot
    Dec 29, 2014 at 19:06
  • Yes, that was my idea - it might be that the provider of your public Wifi is blocking SSH traffic for whatever reasons. Look into their TOS.
    – Sven
    Dec 29, 2014 at 19:07
  • 1
    For outgoing port checks, check out portquiz.net
    – omercnet
    Dec 29, 2014 at 19:20

1 Answer 1

Reset to default
2

You have the right idea in mind by limiting your ssh reachability - but you might be taking it too far.

You could have your SSH rule open to anywhere (0.0.0.0), but with some limitations to provide some security

Few good tips for securing your SSH:

  1. Change the default SSH port - This would throw off all those scanner bots who prowl the internet on port 22. This is by no means a security measure, but only a tool to reduce scanner abuse.
  2. Only allow public key authentication - This would kill any brute-force attempt in the first place
  3. Add 2-step verification - In cases you do want to be able to connect from a "guest" computer, where you don't have your private key, require an additional code for any password-enabled user.

This would be a good start that would eliminate basic threats to your SSH, while allowing proper usability.

Improve this answer
1
  • 1
    Sven Answered The second question In the comments above. Thanks for answering the first one @omercnet!
    – Tom Granot
    Dec 29, 2014 at 19:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .