2

I've got an EC2 instance running on an AWS VPC (free tier), on top of which I'm running a website.

I'm also using an RDS MySQL DB Instance for my database needs, and have set up security groups to allow the following:

EC2 Security Group - Inbound:

  • Allows access to all HTTP traffic via port 80
  • Allows access to SSH traffic from 2 IP adresses I usually sit in via port 22
  • Allows access to all MySQL Traffic via port 3306

EC2 Security Group - Outbound:

  • Allows access to all traffic from all ports

RDS Security Group - Inbound:

  • Allows access to MySQL Traffic from my EC2 security group over port 3306

RDS Security Group - Outbound:

  • Allows access to all traffic from all ports

Usually, when I sit outside of the 2 IPs I mentioned in the security groupt I create a new inbound rule in my default security group for the EC2 instance, which allows SSH access over port 22 from the IP in which I'm currently sitting.

Today, for some odd reason, I cannot connect over SSH to the EC2 Instance. I'm trying to from the public WiFi in the Cafe I'm sitting at. Tried various methods - PuTTY, Sublime SFTP, Filezilla. Nada.

I would love to know 2 things, really:

  1. What am I doing wrong? How to avoid this constant handling of security groups in AWS?
  2. What is the reason I'm not able to connect right now?

Important Note: The EC2 instance is up, and can be accessed over port 80 via HTTP - meaning I can go the URL of the site I set up, and everything is hunky-dory. Cleared cache - still loads perfectly.

  • Can you SSH into other hosts not on AWS? Maybe SSH in general is blocked. – Sven Dec 29 '14 at 18:59
  • Hmmp. I'm not really using any other form of SSH. – t0mgs Dec 29 '14 at 19:00
  • OK - tried to SSH to openshells.net using PuTTY. No luck. Is it possible that I can't open a tunnel over public WiFi? – t0mgs Dec 29 '14 at 19:06
  • Yes, that was my idea - it might be that the provider of your public Wifi is blocking SSH traffic for whatever reasons. Look into their TOS. – Sven Dec 29 '14 at 19:07
  • 1
    For outgoing port checks, check out portquiz.net – omercnet Dec 29 '14 at 19:20
2

You have the right idea in mind by limiting your ssh reachability - but you might be taking it too far.

You could have your SSH rule open to anywhere (0.0.0.0), but with some limitations to provide some security

Few good tips for securing your SSH:

  1. Change the default SSH port - This would throw off all those scanner bots who prowl the internet on port 22. This is by no means a security measure, but only a tool to reduce scanner abuse.
  2. Only allow public key authentication - This would kill any brute-force attempt in the first place
  3. Add 2-step verification - In cases you do want to be able to connect from a "guest" computer, where you don't have your private key, require an additional code for any password-enabled user.

This would be a good start that would eliminate basic threats to your SSH, while allowing proper usability.

| improve this answer | |
  • 1
    Sven Answered The second question In the comments above. Thanks for answering the first one @omercnet! – t0mgs Dec 29 '14 at 19:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.