|
I have a macbook that I've managed to expose (using port forwarding) to the world. It works nicely but I'm worried that, while it's not pingable or otherwise detectable, it might get detected and exploited. What are the main types of security I should look into for this? Also: would it be more (or less) secure to ONLY expose ssh instead of VNC?
| |||
|
feedback
|
|
Ideally you'd at the router level block incoming connections to the Mac except for the specific ip address you expect to come in on. If you want to be able to access it from anywhere, the IP address based blocking isn't going to work for you, so at that point you should come in by VPN. I use OpenVPN for this. Otherwise, it's just the basics, including strong passwords and keeping your system patched and up to date. Regarding whether exposing SSH is more or less secure than exposing VNC, assuming strong passwords and an up to date system, the difference is (in theory) the ability to intercept. I'm not sure what password protection implementation this particular VNC server uses. SSH is secure in this regard. So my gut feeling is SSH-only would be safer. I think your best bet to remotely access is SSH or VPN only. | |||||
feedback
|
|
Using ssh Shut off passwords and use only DSA (or RSA) authentication. Set it up as detailed here under "Using DSA public key authentication" (and the list includes more things). Then disable SSH password authentication entirely, so if you don't have the right id_rsa file, you can't get in. This is detailed here. Also change the default port for ssh. This seems silly but it's not at all. See the comments in the second link above. To actually do it, use the stuff here. Using VNC Do NOT use VNC from the outside. Tunnel it through SSH. This is actually pretty easy to work out. | ||||
|
feedback
|
