Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Is it safe to SSH to a machine while I'm using unsecure wifi network in public places? Machine would also be placed behind a router.

share|improve this question
add comment

migrated from stackoverflow.com Mar 25 '11 at 18:33

This question came from our site for professional and enthusiast programmers.

3 Answers

A few things to be aware of:

Brute force attacks against your SSH server

If you start up a public SSH server, you might want to check the log files to see if anyone is continually trying to connect to it. They might be trying to "brute force" your password, or exploit the SSH server in some other way. It might be a good idea to move the SSH server to some other port (rather than the default of port 22), though this can cause issues if people have poked firewall holes specifically for SSH. (making port 443 a popular choice, if the machine is not also an HTTPS server)

Another strategy for mitigating brute force attacks is to throttle incoming connections to your SSH server (you can do this easily on Linux with something like ufw or whatever firewall tool your platform uses)

Man-in-the-middle attacks

The first time you connect to your SSH server, it will report a key fingerprint to your SSH client, which will cache it. Check the fingerprint carefully. SSH will warn you with a scary-looking error message if this ever changes. If this happens, pay attention to it! You can also get this error if you re-image the server and a new key is generated.

Public key authentication

SSH supports public key authentication. This means you can generate a public/private keypair, where you locally store a private key + passphrase, and the server knows your public key (associated to that private key) is authorized to connect. This allows you to separate your password from your authentication. (if someone succeeds at doing a man-in-the-middle attack or compromises your server in some other way, or manages to get a keylogger onto your client, they'd still need your private key) Beyond the security benefits, it's also more convenient because you generally don't have to enter your password every time you connect. (you just enter your passphrase once when you cache your private key)

share|improve this answer
2  
Pretty good reply. To avoid the brute force attacks, I use portknocking. ( debian-administration.org/articles/268 ) Portknocking is not the best security, but it at least keeps bots away from the ssh daemon. –  Geeklab Mar 25 '11 at 20:35
add comment

It would be as safe as (1) your sshd implementation and (2) your router. Generally, yes.

share|improve this answer
1  
and the client: is it free of malware/keyloggers –  Rich Homolka Mar 25 '11 at 21:38
add comment

In general yes. I would suggest, though, to use your own computer instead of others', and to use generated key rather than password. In general these two provide good enough security.

Note also that you should forward only the necessary ports.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.