A production server with Centos7 in an institutional network (university) is to store a website and to receive data files of an experiment, coming from a big number of computers. The question is about security, since access is done by SSH, but the data files come from computers that are out of our control (in K-12 public educational centers), so SSH-mediated scp is not an option here, and the transfer is done by FTP to a user account (without admin privileges) in the server (anonymous FTP was discarded, as it would bring some other problems). In this situation, password access cannot be avoided, cause FTP needs that, but every day there are around 1,000 failed access attempts to the server. fail2ban has also been activated to content this. Is there any way to keep SSH access and receive the data in a way that password access is avoided? Or, should we simply not worry about failed access attempts?

  • @dsstorefile1 We don't know what computers will be sending data, so it's not possible to allow SSH access to all of them. The program that generates and sends the data file stores the password for FTP access. – nightcod3r May 23 '18 at 4:12
  • If the program stores the password for FTP access it could as well store the password for SCP access... this is the same thing. – Patrick Mevzek May 23 '18 at 6:02
  • You are also mixing different things. You will always get attempts, even if using ssh/scp. To not have them at all means you are filtering at the IP level, with the kernel firewall. It means you need to maintain the list of IP address of all clients. – Patrick Mevzek May 23 '18 at 6:04
  • @PatrickMevzek Sure, someone can also try to access through the SSH protocol, but that's not something I would worry about, safety is then at a different level. As commented before, we can't have that IPs list, there's no such way. – nightcod3r May 24 '18 at 4:27

First, if you're worried about security don't use FTP! With that out of the way…

Is there any way to keep SSH access and receive the data in a way that password access is avoided?

Yes, Public Key Infrastructure (PKI). This is a big subject but it's actually quite simple to set up. Once that's done

  • you'll have as good security as you can hope for on a shoestring budget,
  • you can disable password access permanently, and
  • scp will work with zero extra work.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.