0

I am using putty and private key to access my development server. I used Nmap online port scanner, to see which ports are visible to the public, and in fact, the 22 is open.

My question is, is it possible to hide open port from the public?

If it is not, how secure is the SSH connection with a private key?

I did the following:

  • I placed a private key on the USB key (it is not even on my personal computer.)
  • made configuration you can not log in with "root" username to server.
  • applied Limit option to port 22 with UFW. (I think potential intruders have only 6 attempts, then they go on timeout)

The 22 is the only port opened. My question is, how safe is this? Do hackers have any chance to get in?

1
  • The port itself doesn't matter,its the application thats listens on the port matters,the attacker attacks vulnerability in the application,not the port. – yeah_well Feb 12 at 11:10
2

If you connect to the ssh server from only a known set of ip addresses, then it's a wise idea to restrict access to only allow incoming connections from these addresses. By blocking incoming connections from all other address, this mitigates attacks that may exploit a potential zero-day vulnerability in ssh, or a configuration error.

You can do this in Ubuntu using ufw (uncomplicated firewall). As root, do the following:

ufw allow from x.x.x.x to any port 22

(where x.x.x.x is the ip address that you want to allow incoming ssh connections from).

Then,

ufw enable

That should do it. To be sure, run the following command:

ufw status verbose

This should produce:

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
22                         ALLOW IN    x.x.x.x              

Related:

Is starting an AWS instance with only ssh to port 22 significantly insecure?

Logging in to a VPS using ssh and ssh to another VPS using ssh. Does it improve the security of the second VPS?

1
  • Thank you for your reply. The problem is I don't have static IP:) – filtertips Feb 12 at 18:27
2

Put ssh in a VPN tunnel. Set up a VPN like wireguard, which does not respond to port scans. Make the sshd on the server listen only on the private IP of the wireguard interface. Then ssh into the server using wireguards internal ip on the client. Do the same for other services which don't require public access.

Hackers almost always have a chance to get in. It depends on your hacker. When someone can listen to your traffic on the wire and maybe even spoof it then limiting SSH access only to your IP won't help.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.