Is there a way to close 22 SSH port from public, ubuntu?

Question

I am using putty and private key to access my development server. I used Nmap to see which ports are visible to the public, and in fact the 22 is open.

Is it possible to hide open port from the public?

If not, how secure is the SSH connection with a private key?

I did the following:

• Placed a private key on the USB key (it is not even on my personal computer.)
• Made configuration you can not log in with "root" username to server.
• Applied Limit option to port 22 with UFW. (I think potential intruders have only 6 attempts, then they go on timeout)

Port 22 is the only port opened. How safe is this? Do hackers have any chance to get in?

Answer 1

If you connect to the ssh server from only a known set of ip addresses, then it's a wise idea to restrict access to only allow incoming connections from these addresses. By blocking incoming connections from all other address, this mitigates attacks that may exploit a potential zero-day vulnerability in ssh, or a configuration error.

You can do this in Ubuntu using ufw (uncomplicated firewall). As root, do the following:

ufw allow from x.x.x.x to any port 22

(where x.x.x.x is the ip address that you want to allow incoming ssh connections from).

Then,

ufw enable

That should do it. To be sure, run the following command:

ufw status verbose

This should produce:

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
22                         ALLOW IN    x.x.x.x              

Related:

Is starting an AWS instance with only ssh to port 22 significantly insecure?

Logging in to a VPS using ssh and ssh to another VPS using ssh. Does it improve the security of the second VPS?

Answer 2

Put ssh in a VPN tunnel. Set up a VPN like wireguard, which does not respond to port scans. Make the sshd on the server listen only on the private IP of the wireguard interface. Then ssh into the server using wireguards internal ip on the client. Do the same for other services which don't require public access.

Hackers almost always have a chance to get in. It depends on your hacker. When someone can listen to your traffic on the wire and maybe even spoof it then limiting SSH access only to your IP won't help.

Answer 3

Additional security can be added by changing the port listened to for SSH. Throw on port knocking, where all ports remain closed until the correct combination of ports are pinged in the correct order, and efforts to brute force into a machine via SSH are near impossible.

I imagine the truly paranoid could throw an encrypted key onto the chain as well, but unless you are running some high value server, UFW IP address allow and changing the SSH port are very good options. You really only likely run into trouble with that if the PC on the allowed IP address is hacked.