3

I am preparing to set up an Amazon EC2 instance. It will be a testing and development machine to allow me to put PHP, Python, etc scripts on a server without being tied down to a local machine. Currently I use NitrousIO, but an EC2 box is more attractive for a number of reasons.

However one thing is bugging me. Most documentation clearly states to restrict SSH access to only one's IP address. For most businesses there is probably no issue (and indeed my employer has a set IP range), but my home IP address is dynamic. Is there anyway to limit SSH access to an EC2 instance by IP address in such a situation? I am concerned about being locked out at an inopportune time.

4 Answers 4

2

This will not be an issue if you have access to Security Groups settings for EC2 panel on the Amazon Web Services console.

Whenever logged you can go to the security group bound to your EC2 instance, configure Inbound access and add or change the SSH rules. There is also a convenient dropdown that says "My IP" so it will automatically fill the space with your info and locking you out that instance.

3
  • For extra security I recommend using 2-factor authtentication on the account you use for accessing AWS console.
    – Gus Fune
    Apr 29, 2015 at 0:20
  • I did not see the "My IP" option under security earlier. It is very convenient indeed. Does it change with my IP address or must the field be updated manually?
    – Mike P
    Apr 29, 2015 at 1:39
  • It should show up "My IP" option and it automatically fills with your IP using CIDR format. Which is basically your IP. You can check how it looks like in my screen here in this link: imgur.com/UFc29Qm. If it's not showing up it should be any security feature that you need to check, but you can always enter you IP manually. Be aware that you need to update this setting whenever you IP changes at home.
    – Gus Fune
    Apr 29, 2015 at 5:13
1

You should create a script that adds/removes a security group rule, granting access to your current IP.

Use a web API to get your current IP address. Something like http://api.ipify.org/?format=json

Use the result to call the AWS CLI: http://docs.aws.amazon.com/cli/latest/userguide/cli-ec2-sg.html

Something like this should work:

aws ec2 authorize-security-group-ingress --group-name <SSH_ACCESS_GROUP_NAME> --protocol tcp --port 22 --cidr <MY_IP>

Don't forget to delete the rules too.

0

Couple options come to mind.

1) Ask your local ISP for a static IP whitelist that IP and use it from the local machine.

2) allow it ONLY from your router's Stated IP Range as your are likely to only used a few from that router connection. For Ex. whitelist 123.456.78.90/21 for ssh.

3) if option 1 or 2 are not possible you COULD use the console gui to manually change the "known" current IP for that connection prior to using ssh from the local machine.

4) also possible from the home router set it up to only use a static for that machine so while the ISP may not give you a static IP you could use the lan static IP which would still be routable via the home connection.

0

Even with a dynamic IP, it should be possible to select a range that you'll fall within, either by checking over time what IP you get, or by asking your ISP about the specific IP pool. Once that is done, you can set up a default deny, and allow your IP range this way:

iptables -A INPUT -s 192.168.0.0/16 -j ACCEPT

...ofcourse substituting the IP values with whatever lines up with your findings. The /16 means that the last 16 bits of the IP can be whatever, which lines up with the .0.0 part of the IP.

Warning: Be 100% sure that you set it up before applying the default deny rule, or you'll lock yourself out. If you can, I recommend getting a shell somewhere with a static IP and add that as well, so that you have an alternative route, just in case.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .