3

I think many people may be in my situation. I travel on business with a laptop. And I need secure access to files from the office (which in my case is my home).

The short version of my question:

How can I make SSH/SFTP really secure when only one person needs to connect to the server from one laptop? In this situation, what special steps would make it almost impossible for anyone else to get online access to the server?

A lot more details:

I use Ubuntu Linux on both my laptop (KDE) and my home/office server. Connectivity is not a problem. I can tether to my phone's connection if needed. I need access to a large number of files (around 300 GB). I don't need all of them at once, but I don't know in advance which files I might need. These files contain confidential client info and personal info such as credit card numbers, so they must be secure.

Given this, I don't want store all these files on Dropbox or Amazon AWS, or similar. I couldn't justify that cost anyway (Dropbox don't even publish prices for plans above 100 GB, and security is a concern). However, I am willing to spend some money on a proper solution. A VPN service, for example, might be part of the solution? Or other commercial services? I've heard about PogoPlug, but I don't know if there is a similar service that might address my security concerns?

I could copy all my files to my laptop because it has the space. But then I have to sync between my home computer and my laptop and I found in the past that I'm not very good about doing this. And if my laptop is lost or stolen, my data would be on it. The laptop drive is an SSD and encryption solutions for SSD drives are not good.

Therefore, it seems best to keep all my data on my Linux file server (which is safe at home).

Is that a reasonable conclusion, or is anything connected to the Internet such a risk that I should just copy the data to the laptop (and maybe replace the SSD with an HDD, which reduces battery life and performance)?

I view the risks of losing a laptop to be higher. I am not an obvious hacking target online. My home broadband is cable Internet, and it seems very reliable. So I want to know the best (reasonable) way to securely access my data (from my laptop) while on the road.

I only need to access it from this one computer, although I may connect from either my phone's 3G/4G or via WiFi or some client's broadband, etc. So I won't know in advance which IP address I'll have.

I am leaning toward a solution based on SSH and SFTP (or similar). SSH/SFTP would provided about all the functionality I anticipate needing. I would like to use SFTP and Dolphin to browse and download files. I'll use SSH and the terminal for anything else.

My Linux file server is set up with OpenSSH. I think I have SSH relatively secured. I'm using Denyhosts too. But I want to go several steps further. I want to get the chances that anyone can get into my server as close to zero as possible while still allowing me to get access from the road.

I'm not a sysadmin or programmer or real "superuser". I have to spend most of my time doing other things. I've heard about "port knocking" but I have never used it and I don't know how to implement it (although I'm willing to learn).

I have already read a number of articles with titles such as:

  • Top 20 OpenSSH Server Best Security Practices
  • 20 Linux Server Hardening Security Tips
  • Debian Linux Stop SSH User Hacking / Cracking Attacks with DenyHosts Software
  • more...

Those articles mention things like

  • Use DenyHosts
  • Set the AllowUsers option in /etc/ssh/sshd_config to allow only specific users to connect.
  • Disable root logins via SSH.
  • Use public key authentication and disallow password login
  • and much more.

I am doing all the things above (and some more). But I have not implemented every single thing I've read about. I probably can't do that.

But maybe there is something even better I can do in my situation because I only need access from a single laptop. I'm just one user. My server does not need to be accessible to the general public. Given all these facts, I'm hoping I can get some suggestions here that are within my capability to implement and that leverage these facts to create a great deal better security than general purpose suggestions in the articles above.

One example is port knocking. This seems like a perfect fit for my situation. What else is there along these lines?

9
  • Teamviewer
    – Diogo
    Apr 11, 2012 at 20:41
  • @Diogo Rocha - Teamviewer is not secure, it uses external servers to make the connection between the so called server and the clients.
    – user127350
    Apr 11, 2012 at 20:46
  • @DiogoRocha - wow, interesting idea! I never even considered TeamViewer for this. I will look more into it. Is it really more secure than SSH? EDIT - never mind. I see from Radoo's reply that Team Viewer is not a good choice.
    – Ace Paus
    Apr 11, 2012 at 20:46
  • @Ace Paus - TeamViewer is a VNC like software. I don't think you want a remote desktop connection.
    – user127350
    Apr 11, 2012 at 21:07
  • What is wrong with SSH? Apr 11, 2012 at 21:10

5 Answers 5

4

There's no such thing as perfect security. Every security option is a trade-off. Personally, I recommend:

  1. Use DenyHosts to prevent brute forcing, but set a sensible timeout value so you don't lock yourself out for the entire time you're on the road. That can definitely happen if you aren't careful.
  2. Set the AllowUsers option in /etc/ssh/sshd_config to allow only specific users to connect.
  3. Disable root logins via SSH.
  4. Use public key authentication from your laptop.
  5. Use one-time passwords such as OPIE or OTPW from any public terminal.
  6. Don't ever use your root password from a public terminal, even in conjunction with sudo or su.

Alternatively, I think highly of portable encrypted drives with a PIN-pad, such as the Apricorn Aegis Padlock drives. They're very portable, reasonably secure against most threat models, and the biggest risks are forgetting your PIN or losing the drives while traveling--but in both cases, you still have the original files safely at home.

If you prefer a free alternative, you could use encfs, ecryptfs, or similar to create encrypted mounts to hold your sensitive data. You could lose the data along with the laptop, or someone could tamper with your kernel, bootloader, or hardware to install a keylogger while it's out of your sight, but that doesn't sound like your current threat model, and encrypted mounts should serve your purposes just fine. I don't consider this option quite as secure as the PIN-pad, but it is still a pretty solid choice.

Basically, unless you really feel like you need the services provided by a remote system, I'd recommend just bringing your files in as secure a container as you feel you require. You can then use rsync, conduit, or unison when you get home to synchronize your files, or just copy your updated files back over to your main system.

There really isn't a "one size fits all" answer to your question. Hope this helps.

4
  • Disabling root login and forcing pubkey auth (at least for users in sudo and wheel groups) are a good start. I'd reccommend using fail2ban to surpress automated login attemps to default useraccounts, too.
    – Baarn
    Apr 11, 2012 at 22:54
  • @CodeGnome-Those are excellent recommendations. But I'm already doing all of that. Those are the things mentioned in articles like "Top 20 OpenSSH Server Best Security Practices." For example, Root login is disabled, I'm using PK authenitcation with password login disabled and much more. (And Walter, I'm using Denyhosts instead of fail2ban.) But I want to go to the next level with stuff like port knocking, iptables, etc. I'm looking for stuff I can do because of the fact that I'm only a single user. Port knocking seems like exactly that kind of solution.
    – Ace Paus
    Apr 11, 2012 at 23:52
  • Somebody here knows what he's talking about. +1 :)
    – user127350
    Apr 12, 2012 at 8:10
  • @CodeGnome I see you edited your answer. Thanks for the new information. The Apricorn Aegis Padlock drives look interesting, but according to the reviews the biggest risk seems to be that the drives stop accepting the password and you can't access your own data. Plus, syncing has never worked well for me and I'm hesitant to try it again. But your answer is good advice for most people. It's the best answer yet.
    – Ace Paus
    Apr 13, 2012 at 6:03
1

I'm going to propose port knocking as the answer for how to get to the next level of security on top of the standard SSH hardening that is already being done in this case. The other answers that propose standard SSH hardening are ignoring the fact that those steps have already been taken. This question is about going beyond SSH hardening.

According to Wikipedia,

Consider that, if an external attacker did not know the port knock sequence, even the simplest of sequences would require a massive brute force effort in order to be discovered. A three-knock simple TCP sequence (e.g. port 1000, 2000, 3000) would require an attacker without prior knowledge of the sequence to test every combination of three ports in the range 1-65535, and then to scan each port in between to see if anything had opened. As a stateful system, the port would not open until after the correct three-digit sequence had been received in order, without other packets in between.

That equates to a maximum of 655363 packets in order to obtain and detect a single successful opening, in the worst case scenario. That's 281,474,976,710,656 or over 281 trillion packets. On average, an attempt would take approximately 9.2 quintillion packets to successfully open a single, simple three-port TCP-only knock by brute force. This is made even more impractical when knock attempt-limiting is used to stop brute force attacks, longer and more complex sequences are used, and cryptographic hashes are used as part of the knock.

Port knocking has some limitations (e.g., it is a shared secret). But, as stated in the question, this is a solution for one person. Therefore, port knocking on top of the existing SSH hardening (and denyhosts and other things) is an effective and simple step to take security to the next level.

The wide use of Port Knocker utilities is a matter of controversy among security experts, but this question is a text-book case of when Port Knocking can be used with great effectiveness.

Of course, using port knocking implies using iptables too. So getting to the next step, which is the question here, requires these two steps:

  1. use iptables

  2. use port knocking

This is the particular port knocking implementation I like:
http://www.portknocking.org/view/implementations
There are clients for many popular systems, including Android.

References:

1
  • I'm finding port knocking too difficult to set up... so I'm still looking for solutions. I considered two-factor authentication of SSH with Yubikey. But if someone steals my laptop, they will probably get the key too, so I'm still looking for other ideas.
    – Ace Paus
    Apr 13, 2012 at 5:32
0

Secure Your Files.

Encrypt them before you leave. Then set up your ssh server access your server remotely use keys versus passwords for your ssh server. Download your encrypted file, cut the connection and decrypt your file. No matter what you use you will have to understand that everything you use, can and will be hacked at some point so you have to deter man the acceptable risk for you.

For example, if you have an Apple product you most likely have a factory installed root kit; same thing with Dell, HP, ASUS, all of them. They only work on OS X and Windows XP and newer. So, use Linux.

3
  • Although the border between securing a computer and insane paranoia is only a thin line, most it-sec people manage to balance on it. but you seem to have slipped.
    – Baarn
    Apr 11, 2012 at 22:59
  • Can you proof me the existence of these? "most likely" really means "I'm just guessing". Apr 11, 2012 at 23:57
  • @user127849 - Encrypting files on the server before I leave is not an option. Those files reside on an SSD on the server, and there are no good encryption options for solid state drives. (The server is backed up frequently to external HDDs, fwtw.)
    – Ace Paus
    Apr 12, 2012 at 0:00
0

I'm not an expert on this... but here's what my brain generated:

I would install a VPN server on the server, that would be above the SSH. So firstly you would need your laptop to connect through VPN to get access to the server's SSH.

Another step is to set the server to accept inbound connections only from the VPN IP given to your laptop.

Another thing would be to get an USB modem and speak to your ISP to give you an static IP on that device. This way, you can control the inbound connection of the VPN server, as well.

Use very long passwords. Long passwords even with basic characters are better than small passwords with special chars. Decryption time let's say rise exponentially with the number of characters, not with the number of different characters.

As alternative to SFTP, you can use WebDAV, which is a protocol over HTTP(s), so is as secure as a SFTP, depends on the certificate you generate.

Speaking of which, generate high-encription certificates (1024 bit) for SSH and SFTP/WebDAV.

Make your laptop lock after a few moments of not being used, so stealers won't get information on the fly. On OS X there is a remote wipe option, if the computer gets stolen, but it involves Apple servers I guess. I don't know if there is such a solution for Linux, but you could google a bit about it. Set the clients disable any history features. Anyway if your laptop gets stolen most important is to disable access from it to the server by canceling the accepted addresses and changing the passwords, and certificates.

Mix certificate based login with passwords login (I don't know exactly how it's done), like in some banks systems (where you have a part of the key stored on your computer, and with that your an access the service, and then login with a password) or in Enterprise VPNs.

Now I'm getting paranoid: install also a login system based on a mobile key generator, like those used by Blizzard on BattleNet or Banks. (much research to be done here)

Change the default ports of your VPN/SSH/WebDAV server. Block any other listening ports through a firewall.

Disable application servers' default users used as admin and guests, and create new ones.

OK, my brain returned Stack Overflow for now. :)

Ask the same question here: https://security.stackexchange.com/

Remember one thing: a highly motivated hacker can break into any system.

1
  • Thank you for all the ideas. There's a lot to consider in your response. BTW, SFTP is not FTPS. SFTP is part of SSH, so it is as secure as SSH. And I'm not using passwords for login -- I'm using PK auth.
    – Ace Paus
    Apr 11, 2012 at 23:55
0

I use Ubuntu Linux on both my laptop (KDE) and my home/office server. Connectivity is not a problem. I can tether to my phone's connection if needed. I need access to a large number of files (around 300 GB). I don't need all of them at once, but I don't know in advance which files I might need. These files contain confidential client info and personal info such as credit card numbers, so they must be secure.

You do understand that using your phone's 3G/4G connection is not secure right? The phone company has the ability ( no doubt ) to view all your internet traffic. Now the internet traffic might be secure, but it could in theory, perform a Man in the Middle attack on you. If you use a 3G/4G connection you will want to use a VPN before you upload any content over yet another secure connection.

Given this, I don't want store all these files on Dropbox or Amazon AWS, or similar. I couldn't justify that cost anyway (Dropbox don't even publish prices for plans above 100 GB, and security is a concern). However, I am willing to spend some money on a proper solution. A VPN service, for example, might be part of the solution? Or other commercial services? I've heard about PogoPlug, but I don't know if there is a similar service that might address my security concerns?

Furthermore any files which contain PII and/or confidential client information should be encrypted. You are not doing your clients any favors by not encrypting those files, and ANY storage media, which contains those files. ALL copies should be encrypted.

So using a cloud service really is a solution, provided all your information is encrypted before upload, your only concern would really be retainability in the long term. Cloud storage should be used, you should also have your own local and remote copies you do yourself, depending on how much storage your actually dealing with.

Futhermore...If you really are dealing with 300GB of data a 3G/4G connection really won't cut it.

I could copy all my files to my laptop because it has the space. But then I have to sync between my home computer and my laptop and I found in the past that I'm not very good about doing this. And if my laptop is lost or stolen, my data would be on it. The laptop drive is an SSD and encryption solutions for SSD drives are not good.

Anyone that says that an encrypted SSD device is not 100% secure provided its done BEFORE any data is placed on it is a complete and total idiot and you should not take technical advice from them ever again.

Is that a reasonable conclusion, or is anything connected to the Internet such a risk that I should just copy the data to the laptop (and maybe replace the SSD with an HDD, which reduces battery life and performance)?

It sounds like you should come up with a routine that will sync all your storage devices together. There are solutions....

I view the risks of losing a laptop to be higher. I am not an obvious hacking target online. My home broadband is cable Internet, and it seems very reliable. So I want to know the best (reasonable) way to securely access my data (from my laptop) while on the road.

If your laptops storage device is encrypted, and you encrypt the files, then all anyone would ever have is a laptop with random bytes on it.

I only need to access it from this one computer, although I may connect from either my phone's 3G/4G or via WiFi or some client's broadband, etc. So I won't know in advance which IP address I'll have.

I would use a third-party VPN service, that will allow you to whitelist one specfic ip address, this would allow you to always have the exact same ip address. The use of a long secure random password, encrypted data and encrypt storage media, makes your data 100% secure. Encrypted data is just random bytes.

Unless you store the files encrypted on the server, anything you do will be less secure, then a remote cloud solution. Amazon and Dropbox spends millions to secure their servers, you being a single user, will likely not install every kernal update that is released.

Besides it sounds like you should focus on your clients, doing what you do, then worry about the security of a home linux server that is not as secure as Amazon and Dropbox.

1
  • You didn't really answer my question. For example, I said, "encryption solutions for SSD drives are not good." I did not say that an encrypted SSD couldn't be secure. I was more general because the problems are broad. One problem is trim. Another problem is wear leveling. There are more. Furthermore, I mentioned SSH. It is as secure as a VPN. I can use a 3rd party SSH service for a fraction of the cost and still have a consistent IP address.
    – Ace Paus
    Apr 13, 2012 at 5:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .