Is it secure to bind all private services only to the 127.0.0.1 address, and then use a local SSH client's local port forwarding with an RSA public / private key pair file of 4096 bits and a passphrase to access them? I understand 4096 bits to be secure for the foreseeable future provided nobody steals the passphrase to my SSH public key.
(Depending on what the public facing services are able to access of course)
(And of course after the initial key exchange...)
Also, would it help to limit the number of internal computers allowed to access it using the source address, destination port, and possibly mac address on the firewall of the server?
I suppose too I should turn off access to the root account over ssh, lest someone get in there and make changes to the hosts file.
Would it also help to limit which ports can be connected to using this method? (not sure how to do this, but I'll bet it's in the SSH config)
Is this secure why or why not? And is there anything I can do to make this more secure?