Private REST API accessible only via SSH?

Question

We are trying to bulletproof our server from DDoS / MIM etc.

Use case:

1. Clients (<5 in number) want to get some data from remote server
2. Client open SSH connection to server, they can now access GET REST APIs on server.

Is this a safe architecture? SSH connection is on a non-default port

What could be the advantages of an SSL + OAuth approach?

Answer 1

Regarding the proposed solution

It solves the problem of MITM/DDoS attacks, As long as your HTTP server doesn't serve to non-local requests. However, you are introducing a new attack surface (the SSH port).

A Different Approach (based on client-friendly approach)

Instead of creating another attack surface (SSH),you have other standards to cases like that:

1. Using SSL+OAuth as you have suggested, doesn't add the new attack surface, and let's you ignore requests which are not having a legitimate token. if you decide to implement Oauth based solution - DON'T DO IT YOURSELF, because it's a complicated protocol, an you might end up with a lot vulnerabilities. Of course, there are open sourced libraries for that :)
2. Using SSL + Cookies/Token bearer (such as JWT) - might be even simpler than Oauth.
3. Using Client SSL Cetrificate - since you have only 5 clients, this might be a great fit, since it's super simple, and doesn't require too much boilerplate code and maintenance. Furthermore, in some web servers (such as in Apache HTTP Server) you can validate it in the server, instead of running your own code, which could be translated to a boost in your performance.