0

We are trying to bulletproof our server from DDoS / MIM etc.

Use case:

  1. Clients (<5 in number) want to get some data from remote server
  2. Client open SSH connection to server, they can now access GET REST APIs on server.

Is this a safe architecture? SSH connection is on a non-default port

What could be the advantages of an SSL + OAuth approach?

Improve this question
2
  • Why do you think that SSH solves the DDoS problem? – schroeder♦ Apr 9 '20 at 16:17
  • I'm not an expert, but I assume APIs are not set to public so they can't DDoS / Bruteforce API calls – d.lime Apr 14 '20 at 7:25
1

Regarding the proposed solution

It solves the problem of MITM/DDoS attacks, As long as your HTTP server doesn't serve to non-local requests. However, you are introducing a new attack surface (the SSH port).

A Different Approach (based on client-friendly approach)

Instead of creating another attack surface (SSH),you have other standards to cases like that:

  1. Using SSL+OAuth as you have suggested, doesn't add the new attack surface, and let's you ignore requests which are not having a legitimate token. if you decide to implement Oauth based solution - DON'T DO IT YOURSELF, because it's a complicated protocol, an you might end up with a lot vulnerabilities. Of course, there are open sourced libraries for that :)
  2. Using SSL + Cookies/Token bearer (such as JWT) - might be even simpler than Oauth.
  3. Using Client SSL Cetrificate - since you have only 5 clients, this might be a great fit, since it's super simple, and doesn't require too much boilerplate code and maintenance. Furthermore, in some web servers (such as in Apache HTTP Server) you can validate it in the server, instead of running your own code, which could be translated to a boost in your performance.
Improve this answer
6
  • How does this solve DDoS? – schroeder♦ Apr 9 '20 at 16:16
  • The server will use less resources for each request (especially with client ssl certificate authorization), and still will be able to authenticate the clients. You are right that there might still be a DDoS, but this true as long as he is open to the internet :). Do you think I should add more solutions like iptable? – user3467955 Apr 9 '20 at 16:29
  • 1
    I think we might need to understand what the OP means by DDoS. – schroeder♦ Apr 9 '20 at 16:34
  • @schroder X509 certificate-based SSH will solve DDOS and MITM – postoronnim Apr 10 '20 at 14:39
  • Thanks for all answers! My APIs might have sensitive data and wanna prevent massive data breach/leak. With DDoS I mean: - massive requests to fill server resources and make it unusable to us(I might use Flask Limiter to avoid this) - bruteforce of APIs in order to access data - Man in the middle sniffing So we plan to be less "public" as possible by securing an SSH connection (which is more expensive in terms of resources/maintanance as opposite of a on-demand approach like HTTPS) – d.lime Apr 14 '20 at 7:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.