Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 1 down vote favorite

So I have an OpenSSHD on an Ubuntu machine using static IP address.

My notebook PC has dynamic IP address -> "I mean really dynamic", so there couldn't be any ranges specified...

I need to restrict the SSHD to only show that it's there to my notebook (so no one else could see that there is an sshd listening on some port, only me).

I'm thinking about knockd (It's really simple to implement). Are there any solutions?

share|improve this question

3 Answers

up vote 4 down vote accepted

In all honesty, I'd just set up key-based authentication, disable password authentication, and not worry about people rattling the doorknob. Provided you keep your secret key, secret, all will be well. This question comes up a lot, and in many cases it's motivated by concern over clutter in the log files; while it's annoying, it's also a demonstration that your security policy is working.

If you really need your sshd to be visible only to your notebook, you could set up OpenVPN between it and the server and then configure sshd so that it binds to the tun/tap interface and not to the physical one. But then you're encrypting all your traffic twice, which seems like a waste of entropy, to me.

share|improve this answer
2  
I would agree with the Public/Private key system. Provided the secret key doesn't go missing, you can guarantee the machine saying "Grant me access" is your notebook. Add a password to the key for a little more protection. Might need a little bit of thought on how to prevent access in the event your notebook is stolen. – Alex Chamberlain Jun 11 '12 at 10:51
Good point about using a passphrase on the key. Choose a good strong one, and even if the notebook does go missing, you can be reasonably well assured that no-one will be able to gain access before you have a chance to remove the public key from the authorized_keys file on the server. Of course, there is something of a race condition attaching, but isn't that the very nature of computer security? – D_Bye Jun 11 '12 at 11:17
up vote 0 down vote

I would recommend several ways to implement secure SSH login:

  1. Use deny-hosts to take care about unauthorized access attempts
  2. Use public key authentication.
  3. Disable old/weak protocols in your sshd_config
  4. If possible, change default SSH port from 22 to something 'exotic' like 9876

Here if very good article on how to improve security of your OpenSSHD server.

Also take a look here.

share|improve this answer
I don't want that anyone besides me could see that there is an open port for SSHD, that's the question, but ty – gasko peter Jun 12 '12 at 5:02
@gaskopeter once your IP is not static, you can not restrict access based on IP.That makes sense.You should think about it. – rkosegi Jun 12 '12 at 5:08
true, .. so restricting sshd to only show me that it's there is using knockd. (? - or are there anything else that can limit this?) – gasko peter Jun 12 '12 at 5:11
up vote -1 down vote

You can use no-ip.org services. Register for free an address like my-laptop.noip.org, then download the software to your laptop and anytime your ip changes, the software will update your address for pointing to your new ip address.

You only have to do your SSH connection to my-laptop.noip.org.

Actually I have a service running this way. :D

share|improve this answer
This has nothing to do with the question, where the server has a static IP address but the client has a dynamic IP address. – Gilles Jun 11 '12 at 22:51
yep, the client has dinamic IP, not the server – gasko peter Jun 12 '12 at 5:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.