Currently I can think of three ways:
The first is to use
knockd - my favorite - (http://www.zeroflux.org/projects/knock/) and configure a port sequence only you remember and let
knockd open SSH for the IP address you are referring from.
knockd is available in a debian package and a sample configuration (
/etc/knockd.conf) can be:
logfile = /var/log/knockd.log
sequence = 2221,2222,2223
seq_timeout = 5
tcpflags = syn
start_command = /usr/sbin/iptables -I INPUT -i enp0s8 -s %IP% -p tcp --dport 22 -j ACCEPT
cmd_timeout = 15
stop_command = /usr/sbin/iptables -D INPUT -i enp0s8 -s %IP% -p tcp --dport 22 -j ACCEPT
knockd will listen for a sequence on the specified ports (they might even be the same) and will open the port if the sequence is hit within 5 seconds. After 15 seconds the rule is removed again so a succesfull login needs to be started within those 15 seconds.
The second one is based on dynamic DNS combined with refreshing an iptables chain regularly:
iptables -N SSH
iptables -A INPUT -p tcp -m tcp --dport 22 -j SSH
Schedule a cronjob to run the following script, for example, every minute:
iptables -F SSH
iptables -A SSH -s ddns-entry.com -j ACCEPT
This way the SSH chain is flushed and refilled every interval you have chosen.
Alternatively you can create a (password protected) web page on your Debian 6 host which will allow you to enter an IP address which is saved into
/tmp/currip for instance. Schedule a cron job to run every minute - or, even better, use inotify/incron - and check the
/tmp/currip file and alter the
iptables rule to use the address listed in the file. Since it very depends on the kind of web stack you are using I do not list a sample here.