9

Is it safe to SSH to a machine while I'm using unsecure wifi network in public places? Machine would also be placed behind a router.

1
  • 1
    Since none of the answers here address this directly: SSH stands for Secure Shell, and it encrypts everything by default. So as long as the client (i.e. the machine) isn't compromised it should be good.
    – Mahn
    Aug 8, 2015 at 13:53

3 Answers 3

10

A few things to be aware of:

Brute force attacks against your SSH server

If you start up a public SSH server, you might want to check the log files to see if anyone is continually trying to connect to it. They might be trying to "brute force" your password, or exploit the SSH server in some other way. It might be a good idea to move the SSH server to some other port (rather than the default of port 22), though this can cause issues if people have poked firewall holes specifically for SSH. (making port 443 a popular choice, if the machine is not also an HTTPS server)

Another strategy for mitigating brute force attacks is to throttle incoming connections to your SSH server (you can do this easily on Linux with something like ufw or whatever firewall tool your platform uses)

Man-in-the-middle attacks

The first time you connect to your SSH server, it will report a key fingerprint to your SSH client, which will cache it. Check the fingerprint carefully. SSH will warn you with a scary-looking error message if this ever changes. If this happens, pay attention to it! You can also get this error if you re-image the server and a new key is generated.

Public key authentication

SSH supports public key authentication. This means you can generate a public/private keypair, where you locally store a private key + passphrase, and the server knows your public key (associated to that private key) is authorized to connect. This allows you to separate your password from your authentication. (if someone succeeds at doing a man-in-the-middle attack or compromises your server in some other way, or manages to get a keylogger onto your client, they'd still need your private key) Beyond the security benefits, it's also more convenient because you generally don't have to enter your password every time you connect. (you just enter your passphrase once when you cache your private key)

1
  • 2
    Pretty good reply. To avoid the brute force attacks, I use portknocking. ( debian-administration.org/articles/268 ) Portknocking is not the best security, but it at least keeps bots away from the ssh daemon.
    – Geeklab
    Mar 25, 2011 at 20:35
2

It would be as safe as (1) your sshd implementation and (2) your router. Generally, yes.

1
  • 1
    and the client: is it free of malware/keyloggers Mar 25, 2011 at 21:38
0

In general yes. I would suggest, though, to use your own computer instead of others', and to use generated key rather than password. In general these two provide good enough security.

Note also that you should forward only the necessary ports.

You must log in to answer this question.