Hacker News Reader

Comment by jiggy2011 | Hacker News Reader

jiggy2011

The guide recommends blocking SSH access to anything other than your own IP address. The problem is that my IP number sometimes changes at which point I end up locked out totally.

So to get around this you either have to allow SSH from anywhere or you have to use some remote KVM system. Most of the remote KVM systems seem to be based on Java applets which is not really something you want to enable on your system.

So what is the best way to get around this? Just open up SSH and be diligent about your SSH security? implement port knocking?

View on HN

I do this:

Set up a small AWS server to use as a Web proxy and SSH proxy.

Connect from you home with a remote forward port (for example 2222 to 22) additional to any other local forward ports. Put this tunnel in the startup scripts.

When you are away, connect to your AWS server, then connect locally to port 2222.

Now you've got SSH access to your home machine from anywhere.

I've never tried this, but could you enable access from a given hostname rather than IP address, and then use a dynamic DNS system like http://www.noip.com/ to automatically update a hostname when your IP address changes? Two downsides I can see are that a) you would be vulnerable to DNS poisoning attack on the server side, but that would be the equivalent to just opening it up to all IPs, and b) dynamic DNS systems can take a short while to refresh the DNS record and/or it can get cached by your servers up-stream DNS servers. Some tinkering with your server to make it always use the authoritive DNS servers for your dynamic DNS hostname would help with that.

I'm just thinking out loud, I've never tried any of that!

This may not work for you, but I have a similar situation when I'm at home or I'm travelling. To solve it I set up a VPN at the office (we use Meraki hardware, so it was literally just a click) and connect to this first - then connect to the server.

I did consider that approach, but the closest thing I have to an office is my home (with a dynamic IP) anyway!

I thought of setting up a VPN on a server, but all that would really do is move the problem from securing SSH to securing VPN.

Our provider allows us to modify firewall rules through their control panel. Perfect for when we have a dev working from home or a hotel room for a few days.

Reply on news.ycombinator.com