2

I have an instance that acts as both and SFTP server and a NFS shared drive to our internal network.

The instance has a public IP to receive data over SFTP. That data is saved to a volume that is shared inside my internal network.

I use a security group that allows white listed port 22 traffic, and white lists all ports to my internal network.

The data is sensitive, and since this instance has a Public IP, it's one security group slip up from being opened to everyone.

I would like to remove the public IP from the instance, but it requires SFTP access from the Internet.

The solution I came up with is to create a public load balancer that forwards traffic on port 22 to my instance, add the security group it and remove the public ip from my instance, therefore even if I screw up, the instance is not publicly reachable.

I know ELBs were not meant for this, but in theory it should work. Are there problems with this solution? Is there a better/more preferred way for implementing something like this?

  • The ELB doesn't solve your security concern. You still have ssh available for anyone to attempt to login. – Michael Hampton Nov 4 '16 at 18:27
  • I trust the SSH connection, and the security group that allows white listed port 22 traffic would be added to the elb. The risk is not high in opening up ssh traffic publicly(The SFTP software requires login were we forced long random passwords). The risk is accidentally opening up the nfs access that everyone has to the volume internally. – lonewarrior556 Nov 4 '16 at 19:08
  • NFS has its own ability to restrict by IP address range, which you should already be using. – Michael Hampton Nov 4 '16 at 19:35
  • It has a (in my eyes) big downside: The ip address of the client gets obscured by the load balancer. This is bad for auditing, but also for mechanisms like fail2ban. – Edgar Klerks Jul 4 '17 at 13:31
7

An ELB is the wrong way to do this. Your question isn't as clear as it could be, but I'll answer as best I can. I think you need a private subnet with a DMZ.

I suspect you may be best off with a t2.nano instance (or larger) as your SFTP server, with scripts to move the data to where it needs to go onto your internal server. You could use that instance as a bastion host, so you can ssh to it, and then on to your server in a private subnet. This basically makes a DMZ. If you need outgoing internet access then use a NAT Instance.

If you can replace sftp with S3 then you could eliminate the need for an incoming proxy server, which could be cheaper. You could keep all your data on S3, which is cheaper than EBS.

If you can clarify and expand on your use case you may get better responses.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.