7

So I wish to be able to access my Raspberry Pi (which I keep at home behind a firewall) remotely. One option is to use a static IP address, but as a poor student I don't want to fork out for one, and most of the free options are a bit messier (require regular maintenance etc.). As I understand it, another option is to set up a remote SSH tunnel to a server outside my firewall, which will forward connections to a specified localhost port (say 9999) on the server onwards to port 22 on my Raspberry Pi (through said remote SSH tunnel). Broadly I would be following the steps from Raspberry Pi: Phoning Home Using a Reverse Remote Ssh Tunnel, except for a different purpose.

As it happens my university has a student Linux server which I have a shell account on, so setting all that up should be fine. My question is this: given that the student server is shared, will any user with a shell account be able to use the tunnel to my Pi if they happen upon whichever localhost port I've selected (9999 in the above example)? Or will it only allow me to use that port? Is it possible to create such a restriction?

Obviously I'm not that keen on relying upon security by obscurity to protect the connection and would rather that it is only available to me.

Improve this question
2
  • 1
    If the only obstacle is a static IP, why not use a dynamic DNS service? There are tons of them out there which are free to use. This will be a lot simpler and less prone to breakage than a reverse tunnel.
    – phemmer
    Jan 6, 2014 at 17:25
  • Use dyndns.org to get a free URL like yourname.dyndns.org that always points to your dynamic IP address. Then use port forwarding: linuxintro.org/wiki/Tunneling_with_OpenSSH so you connect e.g. to your firewall's port 2222 and reach your server's port 22.
    – Thorsten Staerk
    Jan 6, 2014 at 18:04

1 Answer 1

Reset to default
4

OpenSSH is secure enough to be accessible over the open Internet, if configured properly. So setting up a reverse tunnel that is publicly accessible is fine, if the forwarded port is secured properly.

Some tips for securing OpenSSH:

  • Protocol 2
  • PermitRootLogin no
  • HostBasedAuthentication no
  • PasswordAuthentication no
  • UsePrivilegeSeparation yes
  • PubkeyAuthentication yes
  • Set up SSH keys for all users who will access SSH remotely
  • Restrict users that can log in with AllowUsers
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .