2

I am by no means an expert in online security so I wanted to outline the steps I am taking to remain as safe as possible yet still make it as easy as possible to gain access to my system from anywhere (within reason).

I have set up an openssh-server on my linux (debian wheezy) PC and enabled port forwarding for port 22. I have also installed the DenyHosts package and set it up with the default parameters (block IP addresses after 10 invalid attempts at the correct username, or 5 invalid username guesses). I have disabled root access directly (ie. attempting to log in as root will fail and after the next attempt your IP will be blocked).

I have allowed only a single user account to be accessible and have used a password that I would consider secure (upper and lower case letters and numbers, nothing obvious or related to me).

Is this a safe setup? Are there any obvious security concerns that I am missing?

I understand that "best practice" is to use a public/private key pair, but I am concerned that this will make it too difficult to log on from a new computer. So suppose I take my laptop (or the device of someone I trust) and use it to log on via putty from the local starbucks or internet cafe. Is this safe, given my current setup? And if not, what would I have to change to make it safe?

I hope these questions aren't too vague. I'm relatively new to this subject.

  • And of course the obvious: keep your ssh server software up-to-date. – agtoever Aug 10 '14 at 12:17
4

Security is a relative concept. I cannot say if a certain configuration is safe because there is always a safer practice. As you have mentioned, using a public/private key pair is more secure but you are unwilling to sacrifice convenience for the added security. Ultimately, you need to find a balance between convenience and security that you are comfortable with.

You might want to look into GeoIP filters to limit your SSH logins from a certain country only. This will prevent brute force attempts from other countries.

More information on GeoIP filters here: http://www.axllent.org/docs/view/ssh-geoip/

Another possible measure is to have SSH listen on a non-default port. Most automated scanners will only scan port 22 and thus will not pick up your server if it is running on other ports. However, there are drawbacks to that as well. E.g. certain locations, internet cafes may block these non-default ports.

More information on non default port here: http://major.io/2013/05/14/changing-your-ssh-servers-port-from-the-default-is-it-worth-it/

2

limbenjamin has the right idea. But alongside his suggestions, you also might want to look into two-step verification services that can send a text to your phone and/or email with a code prior to giving you access to the server.

The following is a good resource for setting up two-step verification through the Google Authenticator app.

https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-two-factor-authentication

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.