0

enter image description here

I'm interested in setting up some basic security on an ubuntu 16.4 vps that I'm working on. I'm reading through https://www.codelitt.com/blog/my-first-10-minutes-on-a-server-primer-for-securing-ubuntu/ and http://plusbryan.com/my-first-5-minutes-on-a-server-or-essential-security-for-linux-servers. Regarding the first article, (and the concept of shutting off ssh access to the root login from outside specific ip addresses) is there any way to check if my home internet ip address is static, to avoid the problem of getting locked out if my home ip address changes (listed in the screenshot)?

Improve this question

4 Answers 4

Reset to default
2

Better to ask your ISP, because I'd different between each other, some provides put users on static IP and newer change it, another rotate user's external IP.

In your case is better to buy external IP from provider, to be sure that you always use your own static IP.

Improve this answer
1

This doesn't answer the question on the title, but is an answer to the concerns of the post in it's entirety.

The best practice woudn't be allowing root access from specific IP addresses. Instead:

  • disable root login with PermitRootLogin no
  • use key based authentication (for all or just for the sudoers)
  • only sudo with a pasword.

This way you will be secure and won't get locked out. If you allow only key based authentication for sudoers, you have two independent layers of authentication before root access: just knowing your password doesn't let anyone in.

Improve this answer
4
  • Thank you. Regarding "PermitRootLogin no", I see the security advantage, but won't you need to login as root potentially in the future?
    – user1592380
    May 21, 2017 at 13:41
  • No need for that. You just need to have a account, any account, because you can sudo (or su root with password even when you are not in the sudoers).
    – Esa Jokinen
    May 21, 2017 at 13:50
  • So just to make sure I'm understanding , In a case where I wanted to make a non-root user and I have set "PermitRootLogin no" : I would login as a non-root user, then do su root with root password , then create new account?
    – user1592380
    May 21, 2017 at 15:45
  • Affirmative. Or sudo with own credentials.
    – Esa Jokinen
    May 21, 2017 at 16:09
1

Difference between dynamic and static ip As the names itself is self explanatory dynamic means it will not be permanent when you connect to Internet from any system/router one ip is allocated from your service provider which helps routing your requests to the world, this ip can be dynamic or static, dynamic ip is allocated on temporary basis or for that particular period which can change time to time

Static ip has to be purchased or bundled with services which you can take from ISP, static ip is permanent which is attached to your system/router it also gives permanent identity to your system, you can use static ip to host multiple services or to simply access your system from anywhere if configured

example: if you use dynamic ip to host a website then every time your ISP changes your ip you have to update your DNS records to keep your website working, but if you have a static ip then you don't need to change ip again and again on DNS

Services which can be hosted using static ip are : VPN, websites, remote access services etc.

You can still use dynamic ip to host services using Dynamic DNS which needs registering your ip on some Dynamic_DNS service provider

Static ip can be added directly to a system/device or to a router it depends on ISP and your requirements

You can check your ip by just typing what is my ip in Google search, if your ip changes often or daily then it is a dynamic, if it doesn't change at all for days it can be static

So here you can use static ip to access your system and pass your public keys from your remote system which will help you to access system in a secure manner, block direct root access to your system instead create one user for remote access you can follow the link to set your user access

Improve this answer
1
  • "if your ip changes often or daily" -- DHCP leases can be and often are longer than a day, and it's perfectly possible to renew the existing lease. I once had the same dynamic IP for over than a year, because the router was never offline. It's also possible (but less used by ISPs) that a static IP is obtained using DHCP (reservation). That's why, to be certain, you should contact ISP.
    – Esa Jokinen
    May 21, 2017 at 13:20
1

If your ISP instructed you to keep your WAN IP address in DHCP/Automatic mode, then your Public IP is Dynamic IP address.

If you were given a pool if IP addresses and asked to configure using 1 IP from that pool, then you are said to have Static IP address.

If you are not administrator, then best way to check is to watch the output for Whatismyip in Google Search Engine.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .