2

here is my setup:

laptop <-USBThetering-> mobile phone <-4g internet-> ... homeADSLrouter <-LAN-> server

  1. Laptop's IP is 192.168.x.x
  2. mobilephone internal IP is 192.168.x.y
  3. mobilephone external IP is .... changes every time
  4. homeADSLrouter external IP is variable also (though dyndns is used to update a specific host to point to that IP)
  5. homeADSLrouter has ability to let though ssh traffic and redirect it to server
  6. server has sshd server running listening on normal port

As the mobile phone's external IP changes every time, is there some mechanism still to restrict access to ssh port on the homeADSLrouter perhaps that is not based on IP but some other mechanism on top, rather than allowing all the world to be able to connect to ssh server (of course user/passwd is still a restriction but I'd prefer a little more)

| improve this question | |
  • 2
    Change the default tcp port 22 to something else. – Ipor Sircer Jun 21 '18 at 9:35
  • yep, that's simple enough:-) – MMM Jun 21 '18 at 10:09
  • 4
    Generate a SSH key pair for the server. Disable root logins over SSH. Disable password authentication over SSH. Now anybody who connects will be asked to present a valid key and the connection will be dropped immediately when they cannot do it; many simple-minded hacking scripts will actually drop the connection themselves when the server says that only public key-based authentication is allowed. – AlexP Jun 21 '18 at 11:22
0

If you are looking to secure your ssh, as Alex P mentioned, it is good to disable root for ssh and if possible just use ssh key logins instead. You might also consider installing fail2ban, which will ban any ip that has a certain number of failed login attempts.

| improve this answer | |
1

You could install knockd and configure port knocking. You'd have to connect to port X Y Z before 22 opens up.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.