So I have an OpenSSHD on an Ubuntu machine using static IP address.

My notebook PC has dynamic IP address -> "I mean really dynamic", so there couldn't be any ranges specified...

I need to restrict the SSHD to only show that it's there to my notebook (so no one else could see that there is an sshd listening on some port, only me).

I'm thinking about knockd (It's really simple to implement). Are there any solutions?

4 Answers 4


In all honesty, I'd just set up key-based authentication, disable password authentication, and not worry about people rattling the doorknob. Provided you keep your secret key, secret, all will be well. This question comes up a lot, and in many cases it's motivated by concern over clutter in the log files; while it's annoying, it's also a demonstration that your security policy is working.

If you really need your sshd to be visible only to your notebook, you could set up OpenVPN between it and the server and then configure sshd so that it binds to the tun/tap interface and not to the physical one. But then you're encrypting all your traffic twice, which seems like a waste of entropy, to me.

  • 2
    I would agree with the Public/Private key system. Provided the secret key doesn't go missing, you can guarantee the machine saying "Grant me access" is your notebook. Add a password to the key for a little more protection. Might need a little bit of thought on how to prevent access in the event your notebook is stolen. Commented Jun 11, 2012 at 10:51
  • Good point about using a passphrase on the key. Choose a good strong one, and even if the notebook does go missing, you can be reasonably well assured that no-one will be able to gain access before you have a chance to remove the public key from the authorized_keys file on the server. Of course, there is something of a race condition attaching, but isn't that the very nature of computer security?
    – D_Bye
    Commented Jun 11, 2012 at 11:17

I would recommend several ways to implement secure SSH login:

  1. Use deny-hosts to take care about unauthorized access attempts
  2. Use public key authentication.
  3. Disable old/weak protocols in your sshd_config
  4. If possible, change default SSH port from 22 to something 'exotic' like 9876

Here if very good article on how to improve security of your OpenSSHD server.

Also take a look here.

  • I don't want that anyone besides me could see that there is an open port for SSHD, that's the question, but ty Commented Jun 12, 2012 at 5:02
  • @gaskopeter once your IP is not static, you can not restrict access based on IP.That makes sense.You should think about it.
    – rkosegi
    Commented Jun 12, 2012 at 5:08
  • true, .. so restricting sshd to only show me that it's there is using knockd. (? - or are there anything else that can limit this?) Commented Jun 12, 2012 at 5:11

you can create a host of type no-ip, duckdns, etc, and use this shell script:


CMD=$(ping -c1 $DYN_IP | head -1 | awk -F' ' '{ print $3}' | sed 's/(\|)//g')

if [ -e $FILE ]; then
        OLD_IP=$(cat $FILE)

if [ $OLD_IP != $NEW_IP ]; then
        echo $NEW_IP > last_ip.txt
        sed -i "/^sshd: $OLD_IP/d" /etc/hosts.allow
        echo "sshd: $NEW_IP" >> /etc/hosts.allow
        echo "Allow ip changed to $NEW_IP"

Add in crontab to run every 5 minutes:

 */5 * * * * root /pathtoyou/script

Credits for user PRIX in this question: https://serverfault.com/questions/187231/accessing-ip-restricted-server-from-dynamic-ip


You can use no-ip.org services. Register for free an address like my-laptop.noip.org, then download the software to your laptop and anytime your ip changes, the software will update your address for pointing to your new ip address.

You only have to do your SSH connection to my-laptop.noip.org.

Actually I have a service running this way. :D

  • This has nothing to do with the question, where the server has a static IP address but the client has a dynamic IP address. Commented Jun 11, 2012 at 22:51
  • yep, the client has dinamic IP, not the server Commented Jun 12, 2012 at 5:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .