3

I am thinking about forwarding port 22, to 22 on the machine behind router, but is it safe? Anyone can try to connect to my public IP on port 22 and then indefinitely try to guess user and password.

Doesn't seem like a good idea. Any suggestions? How is it properly done?

  • Assuming that you are whitelisting IPs? – schroeder Dec 12 '14 at 0:55
  • @schroeder: I'm sorry, I'm not sure what do you mean by whitelisting. Can you please explain? – so_user Dec 12 '14 at 1:08
  • Also since I have 2 machines behind the router, how do I access the other one, if the ssh is only forwarded to one of the machines? – so_user Dec 12 '14 at 1:10
  • You might want to look at security.stackexchange.com/questions/65058/… for more tips on securing your SSH server – limbenjamin Dec 12 '14 at 1:55
  • "whitelisting" means that you only allow certain known IP addresses to access a port. – schroeder Dec 12 '14 at 17:31
7

There are many automated bots out there that will try to attack SSH servers, but if you take a few precautions you can actually make SSH very safe.

  1. Disable password-based login completely, and make public/private key pairs the only way to log in. This page provides information on how you can disable password login, and this one shows you how to set up key pairs. It is basically impossible to brute-force a key, so this step alone will dramatically increase SSH security. The only downside is that you'll have to copy the key to every computer you need to log in from.
  2. Set up rate limiting - block an IP address after a certain number of incorrect password attempts. There are many ways to do this; I use fail2ban but if you search Google you'll find many alternatives. This is important because if you don't block IPs, you'll have bots guessing passwords for literally hours on end. Granted if you are using key-based logins they'll probably never succeed, but they'll still use up a good chunk of bandwidth by generating a lot of junk SSH traffic (and also fill up your logs).
  3. If you know you're only going to access this server from certain IP addresses, you can allow only those IP addresses and block all others.
  4. Disable login as root - the vast majority of bots will try to target the root username.
  5. Check the login logs from time to time for unauthorized access.

If you take these steps you should be ready to open up SSH to the Internet. As long as you keep your keys safe and your server packages up to date, you shouldn't have any issues with SSH security.

EDIT: If you have two machines you need to access but only one public IP address, you have two options: You can set up port forwarding to one machine, and if you need to access the second machine, you would log in to the first one and SSH to the private IP address of the second one from the first one.

Your other option is to change the SSH port of the second machine from 22 to something else (2222, for example). Then you can forward port 22 to the first machine, and 2222 to the second machine. If you need to access the second machine, then you'd specify port 2222 in your SSH client. (Side note: If you want, you can use non-standard ports on both machines to cut down on bot traffic.)

1

If you are the only one accessing the machine, I find it helps to keep your ssh logs clean by picking a non-standard port for ssh.

Yes, this is trivial to bypass if the attacker uses a botnet to do a simple port scan, so adds no security against a serious attacker (though it stops you from being the lowest hanging fruit). Still makes sense to have strong ssh passphrases/keys and other best practices (e.g., disable root logins). But on my VPS, I found it cut down failed login attacks that I would see in the logs from random IP addresses from thousands of attempts a day to zero in the past three months.

Basically just pick a port that isn't being used for other purposes (and I tend to pick ports that aren't used for anything by checking /etc/services to make sure you aren't using a well-known service -- and I also pick ports in the system port range less than 1024), for example 501. Then just do port forwarding in your router to forward incoming TCP requests on port 501 to port 22 on the local machine.

You then connect with ssh -p 501 $your_routers_ip from the outside world. If you setup a .ssh/config file you can put the port in there:

 host example
      Hostname example.com  # or ip address
      User jimbob
      Port 501
      ForwardAgent no
      ForwardX11 no

and then can just do ssh example and it will automatically go to the right port/right user name (and disable X11/Agent forwarding).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.