I did a preliminary search and was unable to find an exact / similar question.

I'm configuring a server in our network, in order to give SSH access to a normal user from a third party.

I'm trying to isolate the server from the network using IPTables on the server. My idea is to block outgoing SSH access to other parts of the network. I'm asking whether this is enough, or should I block anything else, or what precautions should I take on the IPTables side only.

The third party won't have root or elevated access. They'll be able to SSH to server from a single static IP only.

up vote 2 down vote accepted

Generally, for an instance like this, you would have a demilitarized zone (DMZ) to put this server in. A firewall in front of the DMZ would allow SSH to this server from the specified IP address (you mentioned only allowing one static IP) and then a firewall behind the DMZ (between the DMZ and your local network) would block everything else from this server.

What you block is a matter of what the person using the server needs access to. For example, even if you block SSH using IPTables, all other services would be available (ftp, nfs, smb, dns, dhcp, etc - a listing just to give you an idea), so unless you want them to be able to access everything, then you'd need to block all of that.

  • Thanks for your answer. In normal cases, I'd isolate the server in the DMZ, and use an external firewall to the server, however the server is virtual, the hardware is not the DMZ, also the server needs to access some internal services. I've asked the question because I'm not experienced in "egress filtering". Ingress filtering is easier, but it's becoming clear that I need to filter services which the user might interact directly (FTP, SFTP, SSH, SMB, etc.). Thanks again! – bayindirh Oct 14 at 14:54

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.