Home / server / Questions / 392329
Accepted
garconcn
Asked: 2012-05-25 09:08:18 +0800 CST

Should I harden my SSH if I only allow my IP in iptables?

  • 772

I have several Linux servers without hardening the SSH:

  1. Allow root logins

  2. Use same password for all the servers

  3. Use default ssh port 22

But I have setup iptables to allow only my own IP to SSH to the server. Will this mitigate the above insecure practice?

security ssh

4 Answers

  1. The answer is always yes. You never know what could happen.

    • 4
  2. Best Answer

    1. Allow root logins

    2. Use same password for all the servers

    3. Use default ssh port 22

    Changing each of the above is a strategy of risk mitigation. Changing all of those things doesn't make you safe. Leaving isn't dangerous by nature of itself. It does increase risk, but you might appreciate the convenience more than the risk.

    For full TCP exchanges like are required with SSH, controlling the IP access range is reasonably effective against anybody who isn't a part of your network (same layer 2 branch or controlling upstream routing).

    You do run the risk where one server compromise could expose the password for all, but you've limited where one can use the password from.

    ... but if the convenience is worth it, you feel ok, and these aren't subject to holding somebody else's important data, go for it. Just know why one would make those changes and what you're giving up for the convenience.

    • 4

  3. If it were me, I'd:

    • lockdown ssh
    • set up private/public key logins for a normal user to automate the login
    • su - once I logged in

    Because it just isn't worth the worry

    (This has the added benefit of allowing access from anywhere you have putty and your ssh key)

    • 3

  4. IP Addresses can be spoofed. Lock your SSH down.

    • 0