1

I am looking to move my business into a small office. I have found somewhere very suitable but unfortunately they cannot provide a static IP address.

Currently, to connect to my server from home I only allow access from my static IP address. Authentication is done through an SSH key so there are no passwords involved. I have Fail2Ban set up on the server to improve SSH security.

My worry is that whilst SSH key-based authentication may be very secure - is it secure enough to leave the SSH port open? I don't know how often the IP will address change but I know it's not static - for arguments sake I'm going to say it changes every day.

Do I need to ensure my new office space can provide a static IP address or can I work around this?

Improve this question
4
  • maybe use a VPN?
    – Bomskie
    Commented May 31, 2016 at 13:57
  • If the key pair is strong enough (4096 bits for example), I'd say it's pretty secure (the server is only encrypting data and has no means to decrypt the data it sent). I suggest you change the SSH port to harden yourself against massive port scans and you are good. I did not receive any failed login attempts since the last 3 weeks.
    – GiantTree
    Commented May 31, 2016 at 13:59
  • This is probably going to be a bit broad - there are lots of servers out there with port 22 open using key based login, but equally there are lots which have IP based restrictions, and quite a few with just password based login. It's going to come down to your specific requirements, and the level of security you are happy with. You could presumably get your own line to the office, which would offer a static IP, or a VPN, or add 2FA to your server. Lots of options, but they all depend on your risk posture.
    – Matthew
    Commented May 31, 2016 at 14:00
  • Is this a mistake: "to connect to my server from home I only allow access from my static IP address." - so your home has a static IP address? Or do you mean your "home server"?
    – TTT
    Commented May 31, 2016 at 19:48

1 Answer 1

Reset to default
1

Somebody brute forcing my SSH key is not an issue in my mind, somebody with resources like that (if it is even possible) can easily break into your office.

Listening on a non standard SSH port is something that many people recommend, and it can't hurt. (Probably does not help either.)

The only issue I worry about with a public ssh port is that if there is a security flaw in the SSH server my server could maybe be compromised. For that reason I have automatic updates turned on. For my "low to medium" value server that is enough, I feel. Because if that ever happens most of the internet will be at risk.

If your server is of higher value you could:

a) Look at setting up one server that listens to connections on an open ssh port and your other servers only listen to connections from that server. (Maybe even over a private network if your host has something like that).

b) Look at setting up a VPN.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .