I am implementing a home alarm system with raspberry and I need to access it from the external network. The initial idea was to use cascade VPN and ssh (in my university to connect to the cluster I had to first connect to the University network and then use ssh). But if via VPN I connect to the raspberry address then I cannot give commands via ssh because I'm in 'local', no? ... So I should either use ssh more fail2ban or use VPN. But could I be calm with one of these two methods? Can I use ACL somewhere? It would not be nice if someone could open the gate or access the cameras...
I will assume you mentioned a university as a point of the environment and are not considering censorship. But an OpenSSH server will work well here. While not advisable I assume you will use the
root user, do ensure a respectable password is used, this goes for any user allowed for SSH login. If concerns that password authentication (interactive-keyboard) is not for you, look at public key authentication, using ED25519 521-bits or RSA 4096-bits.
/etc/ssh/sshd_config harden the following:
Port 30000 LogLevel VERBOSE LoginGraceTime 120 PermitRootLogin yes PermitEmptyPasswords no # Ideal session timeout ClientAliveInterval 600 ClientAliveCountMax 0 # Enhanced Authentication KexAlgorithms diffie-hellman-group-exchange-sha256,ecdh-sha2-nistp521 Ciphers aes256-ctr,aes128-ctr MACs hmac-sha2-512,hmac-sha2-256 AllowUsers root
I make a point to mention, CTR is preferred over CBC for OpenSSH exclusive, see: 'Plaintext Recovery Attacks Against SSH'. The port used for the SSH is your choice if exposed to the Internet use a non-standard port, because of botnets.
Fail2Ban is a viable choice for brute force protection. Consider the following configuration:
[ssh] enabled = true filter = sshd port = 3000 bantime = 600 findtime = 120 maxretry = 5 logpath = /var/log/auth.log
Of course adjust based on your needs, as I long bantimes can be a problem if you accidentally lock yourself out. Furthermore, I would advise keeping Fail2Ban enabled if public key authentication is enabled. As it will reduce traffic in the event of a botnet brute force, and hence CPU consumption.
Test your configuration with
$ hydra -l root -P /root/rockyou.txt 192.168.1.100 -t 4 ssh where
rockyou.txt is a wordlist. This is to ensure brute force protection is working properly. You can generate a wordlist with
crunch or download one. Also, using
nmap ensure the only open ports are those you desire to be exposed to your network interface.
While I won't expand on it, OpenVPN is another viable option, but I only consider this over SSH when I need censorship circumvention.