I run a server on a hosting. I want to harden it, but ssh access is giving me a bit of concerns.
I usually access from home most of the times. I have a provider subscription with the usual DHCP setup which assigns some IP address to my home. Usually it's the same. But I know it has changed some time.
The server has
ufw running. Right now, I have a rule closing down ssh access to a
/16 address range because I don't want to risk myself being locked out if the provider changes IP and I have a host-only access to the server.
SSH access is by ssh keys btw, not password, root access is disabled and only a user can acccess.
So I thought I might be installing an OpenVPN server on the remote server and configure it to allow access via certificates only. I like this because it would allow me to be flexible and access from anywhere provided I have the certificate.
However, this got me thinking.
- This means that the VPN server port needs to be accessible from anywhere, while if the access is firewall based, I could lock down
- The certs become the weak point, obviously if those get compromised they get full access (can the client certificates be password protected? I thought that doesn't apply)
- On the other hand, for example if I request a static IP from my provider (of course, additional costs...), I could lock it down to my home only, but then I wouldn't be able to access from some other location.
I am even considering a small low-resource VPS somewhere to be the jumphost, but then I have to secure that one. At least the "target" server is locked down to just one or two addresses.
What are best practices to secure the ssh access in my case?