I am setting up AWS stuff and wondering how to setup a secure bastion host. They all say to only allow access to your IP address, but how can I do that if my IP address is changing every few hours or days (just in my house wifi, or going to coffee shops, etc.). What is best practice here, for SSHing into a bastion host and limiting access somehow to only specific IP addresses. If not possible, what is the next best alternative?
In the case described above... Instead of changing the security group everytime you go somewhere I would strongly advise using the AWS VPN. The VPN allows you to connect to a static IP directly. You use a VPN to connect to the AWS enviorment securely and can allow the security group to access the ip from the VPN.
I resolve this by compromising and allowing connections from anywhere on the public internet, but I have safeties in place:
- Use fail2ban to lock out persistent attackers
- Disallow root from any sort of ssh login (
- Disable passwords (
- Follow other guidelines from Stribikia's Secure Secure Shell guide
- Use an alternate port
If you don't feel that's sufficient, you can also implement a portscan detector that blocks public IPs that scan you (e.g. with PortSentry or even within fail2ban) and/or hide from them with port knocking, but note that port knocking is security through obscurity and a sophisticated attacker can observe you performing a port knock and then be able to replicate that elsewhere. There are ways to implement a cryptographic port knock (like the outdated cryptoknock), but I don't know of any that use modern cryptography.
I'd consider port knocking decently safe given fail2ban, port-scan blocking, regular rotation of your port knock sequence, and regular reviews of your logs (since fail2ban doesn't permanently ban anything; you'll have to ban persistent CIDRs manually). Remember: if you're concerned about attacks from a state actor, you will eventually lose without significant active defensive resources.