Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I administer a webserver, and while I'd like to restrict the SSH access to an IP range, I wouldn't be able to do so because a) I travel a lot and b) I don't have a static IP at my homeoffice.

I've thought of using a VPN service like ProXPN, which I'll certainly do to increase the security of the connection from less secure places, but then everybody on the same VPN server could also try to connect. While this would definitely be more secure than leaving the port open to everyone, it still doesn't seem like a solution that'd make me happy, also because I wouldn't be able to access my server while the VPN service is down.

Any ideas?

Thanks a lot

share|improve this question
Depending on the perimeter device that you have, you could setup a VPN connection(IPSEC) to that perimeter device with your Laptop.SSH should be allowed only through this VPN. You can configure the VPN in such a way that only your laptop would be allowed external access.You can use open source tools to setup a VPN on your Laptop and internet to route encrypted traffic to your perimeter device. – aRun Apr 26 '13 at 10:22

Setup ssh key authentication and disable password authentication (ensure you don't lock out yourself!)

In order to log in, an attacker would need to prove they own the same ssh key as you, which -barring bugs such as the debian fail- would be infeasible.

share|improve this answer

Here's a small project I wrote, which uses geoip to keep track of the places people log in from and sends out an alert when someone logs in from a geographical location not previously seen for that user: howler.

It doesn't prevent anyone from logging in, but it's pretty effective and quickly becoming aware of unusual login patterns.

share|improve this answer
That is actually kinda cool. Thanks, I'll check it out – Victor Apr 26 '13 at 6:03

You can also just filter connexion with MAC Address. So you will authorize just some specific devicce to access this port. (I know about MAC spoofing, but every solutions has threats...)

share|improve this answer
MAC addresses are not relevant, the MAC that you would see on the server would almost certainly never change, due to it being some on-premises routing device. The 'source mac' you see in an ethernet frame is only that of the last device the frame passed through. – lynks Apr 26 '13 at 11:10

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.