Is SSH server secure from internet access outside private network?

Question

I have a desktop computer in my home network with SSH server running on it. Using another computer in my private and local network (class C IP addresses: e.g., 192.168.0.2, etc) I sometimes use SSH to enter into the desktop PC with command ssh <user_name>@192.168.0.2 and work remotely.

I am wondering if someone from the internet (thus from outside my local network) may gather access to my desktop computer via SSH (i.e., by guessing the user_name and password). Is this SSH server/service accessible from the outside if the username and password are known? Or is impossible to gather access without knowing other details such as the IP of the network gateway and others.

My goal is to keep using SSH internally in my local network but at the same time block any possibility to gain access to any device in the network from the outside. So securely use SSH.

Answer 1

SSH is a professional grade protocol, and most server and client SSH software have been intensively scrutinized for possible flaws, so if you use it in a conformant way it is secure.

Simply best practices recommend to have more than one defense line. If you want a professional grade security, you must behave as a professional admin:

• if it is an option, prefere ssh keys to passwords, because they are deemed impossible to guess
• add an additional defense line at the router level by ensuring that no input connection to a SSH port are allowed - for a private network, ensure that no incoming connection at all are allowed
• add a last defense line at the server level by only allowing local addresses

It implies a bit of configuration but security only comes at that price.

Answer 2

Connections from the Internet to a private address aren't possible per se, but there are some more indirect attack vectors to consider:

1. Vulnerabilities in the router or in its configuration. There could e.g. be a port forwarding from the external IP address to the private network address, enabling connectivity from the outside. A vulnerability in the firmware of the router or using weak or even default passwords on it may allow adding such configurations.

2. Lateral movement from a compromised computer on the same LAN.

3. Lateral movement from a compromised or backdoored IoT device on the same LAN.