1

I have an IP camera that has an HTTP panel through which I can watch live recording of the camera. I need to remotely watch my IP camera, but I don’t want to open port 80 on the router, for known security reasons. I want to connect through an SSH tunnel.

  1. To create an SSH tunnel is necessary to open port 22 on the router? If yes, are there risks to opening port 22? Can hackers exploit?

  2. For example HTTP Basic Auth is easily bypassable, is the same also for SSH Login, or this isn’t bypassable if you don’t know the username and password?

2
  • 1
    You should make sure that any devices you have behind your router are secured on port 22 as well. If they are running any SSH services, then they should be secured, or turn off SSH.
    – David
    Feb 28 '20 at 3:11
  • "HTTP Basic Auth is easily bypassable" It is not. Why do you think it is? Mar 29 '20 at 12:28
2

2- For example HTTP Basic Auth is easily bypassable, is the same also for SSH Login, or this isn’t bypassable if you don’t know user and password?

Not sure why you mean it's bypassable. It certainly doesn't need to be. Assuming you are using a secure layer like HTTPS (so credentials aren't sent in the clear), a good implementation could be secure. Devices like ip cameras often don't have good and secure implementations, though, so it's wise not to expose them directly.

In contrast, ssh servers are generally very well implemented, and thus are unlikely to have vulnerabilities like those often found in those IoT devices.

With no vulnerabilities, the only way to log in would be to know (or successfully guess!) the user and password. Note that with SSH, you could disable passwords and connect using a ssh key (that's akin to using a client certificate with HTTPS, although not something I have seen any ip camera to support).

1- To create SSH tunnel is necessary to open port 22 on router in which is connected the camera?

You will need to open the port the user connects to. SSH is often placed on port 22, but you could choose to place it at any other port number if so you wish.

Please note that you need a ssh server to connect to. The camera probably doesn't include that, so you may need another computer that you will proxy through, or perhaps you want to connect through the router, which need to be secure itself.

If yes, is there risks by opening port 22?

You are exposing a system that wasn't previously exposed on the internet. In case someone got access to the system providing the ssh service, they would get more than if they just got access to the ip camera.

Can hackers exploit?

It will depend if the implementation used has vulnerabilities that could be exploited.

0

If yes, is there risks by opening port 22?

Servers with port 22 open are prone to brute-force attacks. The best option is to change the SSH port to a higher available port (31000, 41762, etc). If connection is always going to be from the same IPs, allowing only connection from those IPs is advisable.

2
  • Changing the port from 22 to another port only reduces the noise but does not prevent you from brute force attacks. The attacker only needs more time to scan your server. The best option is to limit access with a firewall and fail2ban. Mar 9 at 11:03
  • 22 is always better than any port that is not a system port, in case of sshd crush any user can restart it and get the access.
    – Al Po
    Apr 9 at 14:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.