Is it safe to SSH to a machine while I'm using unsecure wifi network in public places? Machine would also be placed behind a router.
migrated from stackoverflow.com Mar 25 '11 at 18:33
A few things to be aware of:
Brute force attacks against your SSH server
If you start up a public SSH server, you might want to check the log files to see if anyone is continually trying to connect to it. They might be trying to "brute force" your password, or exploit the SSH server in some other way. It might be a good idea to move the SSH server to some other port (rather than the default of port 22), though this can cause issues if people have poked firewall holes specifically for SSH. (making port 443 a popular choice, if the machine is not also an HTTPS server)
Another strategy for mitigating brute force attacks is to throttle incoming connections to your SSH server (you can do this easily on Linux with something like
The first time you connect to your SSH server, it will report a key fingerprint to your SSH client, which will cache it. Check the fingerprint carefully. SSH will warn you with a scary-looking error message if this ever changes. If this happens, pay attention to it! You can also get this error if you re-image the server and a new key is generated.
Public key authentication
SSH supports public key authentication. This means you can generate a public/private keypair, where you locally store a private key + passphrase, and the server knows your public key (associated to that private key) is authorized to connect. This allows you to separate your password from your authentication. (if someone succeeds at doing a man-in-the-middle attack or compromises your server in some other way, or manages to get a keylogger onto your client, they'd still need your private key) Beyond the security benefits, it's also more convenient because you generally don't have to enter your password every time you connect. (you just enter your passphrase once when you cache your private key)
It would be as safe as (1) your sshd implementation and (2) your router. Generally, yes.
In general yes. I would suggest, though, to use your own computer instead of others', and to use generated key rather than password. In general these two provide good enough security.
Note also that you should forward only the necessary ports.