1

All my hardware devices are physically secure. They access the internet via this same or similar Bell Canada home device known as the "Home Hub 2000" via a WiFi network with encryption and a hard-to-guess password. Exactly two people know the hard-to-guess WiFi password and they are trusted and that number is not likely to grow. I also connect to that WiFi network via a wireless network bridge, specifically this one, which I connected via ethernet to a grid which is comprised of this switch to which I connected some Ubuntu computers that have an ethernet interface but no other. I have not enabled the software firewall in the individual computers that comprise the grid.

The Home Hub settings:

  • UPnP (Universal Plug and Play) is on.
  • DLNA is on. DLNA is described as being a means of sharing USB drive data but there are no USB drives connected to the Home Hub device.
  • DMZ is off.
  • DDNS (Dynamic DNS) is off.
  • Port forwarding has zero rules.

I will soon add openssh-server the Ubuntu computers. The purpose is to deploy and run software on the grid. I will use ssh and rsync (in ssh mode) not because I know of a security risk but just because ssh is the "normal" way to get work done. If my user password is short and easy-to-type will it matter much in the context that I have described? Essentially I'm not sure if there are risks I need to be aware of, apart from the WiFi password, WiFi encryption, port forwarding, and physical security, hence this question.

Edit: I've decided to turn off UPnP and DLNA since I don't use them and they might be risks.

  • And the ssh servers are not going to be accessible from the Internet? Are you at all concerned about someone gaining control over one of your computers and traversing your network? – schroeder Jan 25 '17 at 7:47
  • I don't know if they are accessible from the internet which is why I posted the question. I'm concerned about theft of data. – H2ONaCl Jan 25 '17 at 7:48
  • 1
    So, your real question is whether your servers are exposed? – schroeder Jan 25 '17 at 7:49
  • Yes. That is right. – H2ONaCl Jan 25 '17 at 7:50
  • 2
    Whoa, ok, totally different question than what you've asked. First, if you are unsure, then you absolutely need to add the layer of defence that includes tough passwords. Second, we can't really provide a network architecture review. We certainly can't dissect each device in your network to tell you if there are known vulnerabilities in them. – schroeder Jan 25 '17 at 7:54
3

Defence-in-Depth is a concept where you employ various layers and levels of security at different points along the path between a potential user and what you want to protect.

In your case, you want to protect the access to your ssh servers. You are right to review and enhance the security of your perimeter and routers, but as you've assessed, there are a lot of moving parts and any one of them can fail. By using strong passwords, even if you never intentionally expose the servers to the Internet, then you have some level of protection even in a complex environment.

  • This is the selected answer because I think defense-in-depth is a valuable concept even if I decided to use a trivial password on the server grid. – H2ONaCl Jun 22 '18 at 4:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.