1

I am using an Ubuntu desktop at my house, and I want to access my computer from school on my Ubuntu laptop and on termux with my Android phone. I heard that I have to use port forwarding. Is this safe for my desktop and other computers on my network? What are some precautions I could take?

3
  • 1
    If you have an SSH service accessible from the Internet, it will be attacked, so you need to make sure it's properly locked down. See this previous question (which this might be considered a duplicate of) and this security.SE question (which is closed, but nonetheless has some good recommendations). One I'll add: make sure you use hard-to-guess passwords on your accounts! Mar 26, 2020 at 5:42
  • You don't necessarily need Port Forwarding. A safer option would be to use VPN. Some routers offer to run a builtin VPN Server. Regarding your questions: Letting a computer to be accessed from the Internet is not safe. You have to care a lot about the security. Harden your ssh-server. Keep up with updates ... If your computer can be hacked, the other computers in the network are also under attack.
    – pLumo
    Mar 26, 2020 at 7:54
  • I am not sure how what you mean by using VPN, I just want my desktop to be accessible on other networks.
    – user398085
    Mar 26, 2020 at 20:17

1 Answer 1

1

Unless you know the IP address/range used by your school, you will need to allow access (either port forwarding or VPN) for any IP address, and as a result, anything on the internet may attempt to access the forwarded port or the VPN server.

Yes, anything. That includes numerous worms and hacked systems that spend their time scanning the internet to find new systems to break into. If you look at your system logs after enabling port forwarding, you'll soon see login attempts from various locations all over the world.

Whether they will be successful or not will depend on how secure you can make the service you're allowing: long and complex passwords are better than easily-guessable ones, and certificate or SSH-key-based authentication is probably better than any password-based authentication.

If you decide to port forward the SSH service, I would recommend that you first set up SSH key authentication between the desktop and the laptop+phone, edit /etc/ssh/sshd_config to add the setting:

PasswordAuthentication no

and then restart the SSH service.

With this setting, no password at all will grant SSH access to your system, although the SSH server may still ask for one, just to make an intruder waste their time. Only key-based authentication will actually work.

3
  • I changed tried changing that file, but how do I connect to it?
    – user398085
    Mar 26, 2020 at 17:44
  • It says[email protected]: permission denied (publickey).
    – user398085
    Mar 26, 2020 at 17:46
  • Nevermind I figured it out
    – user398085
    Mar 26, 2020 at 20:18

You must log in to answer this question.