I am looking to move my business into a small office. I have found somewhere very suitable but unfortunately they cannot provide a static IP address.

Currently, to connect to my server from home I only allow access from my static IP address. Authentication is done through an SSH key so there are no passwords involved. I have Fail2Ban set up on the server to improve SSH security.

My worry is that whilst SSH key-based authentication may be very secure - is it secure enough to leave the SSH port open? I don't know how often the IP will address change but I know it's not static - for arguments sake I'm going to say it changes every day.

Do I need to ensure my new office space can provide a static IP address or can I work around this?

  • maybe use a VPN? – Bomskie May 31 '16 at 13:57
  • If the key pair is strong enough (4096 bits for example), I'd say it's pretty secure (the server is only encrypting data and has no means to decrypt the data it sent). I suggest you change the SSH port to harden yourself against massive port scans and you are good. I did not receive any failed login attempts since the last 3 weeks. – GiantTree May 31 '16 at 13:59
  • This is probably going to be a bit broad - there are lots of servers out there with port 22 open using key based login, but equally there are lots which have IP based restrictions, and quite a few with just password based login. It's going to come down to your specific requirements, and the level of security you are happy with. You could presumably get your own line to the office, which would offer a static IP, or a VPN, or add 2FA to your server. Lots of options, but they all depend on your risk posture. – Matthew May 31 '16 at 14:00
  • Is this a mistake: "to connect to my server from home I only allow access from my static IP address." - so your home has a static IP address? Or do you mean your "home server"? – TTT May 31 '16 at 19:48

Somebody brute forcing my SSH key is not an issue in my mind, somebody with resources like that (if it is even possible) can easily break into your office.

Listening on a non standard SSH port is something that many people recommend, and it can't hurt. (Probably does not help either.)

The only issue I worry about with a public ssh port is that if there is a security flaw in the SSH server my server could maybe be compromised. For that reason I have automatic updates turned on. For my "low to medium" value server that is enough, I feel. Because if that ever happens most of the internet will be at risk.

If your server is of higher value you could:

a) Look at setting up one server that listens to connections on an open ssh port and your other servers only listen to connections from that server. (Maybe even over a private network if your host has something like that).

b) Look at setting up a VPN.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.