I am setting up AWS stuff and wondering how to setup a secure bastion host. They all say to only allow access to your IP address, but how can I do that if my IP address is changing every few hours or days (just in my house wifi, or going to coffee shops, etc.). What is best practice here, for SSHing into a bastion host and limiting access somehow to only specific IP addresses. If not possible, what is the next best alternative?

  • For AWS you can use the SSM agent to get a cli session on the machine without actually using SSH - you can open the session from within AWS Jul 31, 2020 at 19:37
  • @ConorMancone but it uses HTTPS from my understanding. How is that any more secure than SSH? It is still exposing a port to the world... Is it because of the logging and the logging alone?
    – Lance
    Jul 31, 2020 at 19:40
  • With the AWS SSM agent you don't have to export a port to the world since you're not connecting from your home/office. You connect to the instance through the AWS console. Aug 26, 2020 at 1:12

2 Answers 2


In the case described above... Instead of changing the security group everytime you go somewhere I would strongly advise using the AWS VPN. The VPN allows you to connect to a static IP directly. You use a VPN to connect to the AWS enviorment securely and can allow the security group to access the ip from the VPN.

  • How does the VPN connect to the static IP address in the first place? At some level the IP address of my network is still changing, so I'm curious how a VPN solves this. More of a tangent to the main question :)
    – Lance
    Jul 31, 2020 at 19:42

I resolve this by compromising and allowing connections from anywhere on the public internet, but I have safeties in place:

  1. Use fail2ban to lock out persistent attackers
  2. Disallow root from any sort of ssh login (PermitRootLogin no)
  3. Disable passwords (PasswordAuthentication no & ChallengeResponseAuthentication no)
  4. Follow other guidelines from Stribikia's Secure Secure Shell guide
  5. Use an alternate port

If you don't feel that's sufficient, you can also implement a portscan detector that blocks public IPs that scan you (e.g. with PortSentry or even within fail2ban) and/or hide from them with port knocking, but note that port knocking is security through obscurity and a sophisticated attacker can observe you performing a port knock and then be able to replicate that elsewhere. There are ways to implement a cryptographic port knock (like the outdated cryptoknock), but I don't know of any that use modern cryptography.

I'd consider port knocking decently safe given fail2ban, port-scan blocking, regular rotation of your port knock sequence, and regular reviews of your logs (since fail2ban doesn't permanently ban anything; you'll have to ban persistent CIDRs manually). Remember: if you're concerned about attacks from a state actor, you will eventually lose without significant active defensive resources.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .