I administer a webserver, and while I'd like to restrict the SSH access to an IP range, I wouldn't be able to do so because a) I travel a lot and b) I don't have a static IP at my homeoffice.

I've thought of using a VPN service like ProXPN, which I'll certainly do to increase the security of the connection from less secure places, but then everybody on the same VPN server could also try to connect. While this would definitely be more secure than leaving the port open to everyone, it still doesn't seem like a solution that'd make me happy, also because I wouldn't be able to access my server while the VPN service is down.

Any ideas?

Thanks a lot

  • 1
    Depending on the perimeter device that you have, you could setup a VPN connection(IPSEC) to that perimeter device with your Laptop.SSH should be allowed only through this VPN. You can configure the VPN in such a way that only your laptop would be allowed external access.You can use open source tools to setup a VPN on your Laptop and internet to route encrypted traffic to your perimeter device.
    – aRun
    Apr 26, 2013 at 10:22

3 Answers 3


Setup ssh key authentication and disable password authentication (ensure you don't lock out yourself!)

In order to log in, an attacker would need to prove they own the same ssh key as you, which -barring bugs such as the debian fail- would be infeasible.


Here's a small project I wrote, which uses geoip to keep track of the places people log in from and sends out an alert when someone logs in from a geographical location not previously seen for that user: howler.

It doesn't prevent anyone from logging in, but it's pretty effective and quickly becoming aware of unusual login patterns.

  • That is actually kinda cool. Thanks, I'll check it out
    – Victor
    Apr 26, 2013 at 6:03

You can also just filter connexion with MAC Address. So you will authorize just some specific devicce to access this port. (I know about MAC spoofing, but every solutions has threats...)

  • 2
    MAC addresses are not relevant, the MAC that you would see on the server would almost certainly never change, due to it being some on-premises routing device. The 'source mac' you see in an ethernet frame is only that of the last device the frame passed through.
    – lynks
    Apr 26, 2013 at 11:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .