Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I run an SSH server on my main machine. What are the security risks here, and advantages/disadvantages to port forwarding or a DMZ?

Also, is there a way to tunnel an SSH server without making changes in the router?

share|improve this question
add comment

1 Answer 1

Security risks

SSH operates on a well-known port. You can reduce the number of criminal attacks by switching to an obscure port number (but note, obscurity is not security). These attacks are a nuisance which fill logs files and use resources.

The biggest risk is that you allow password authentication in SSH. Most break-in attempts try thousands of combinations of popular user names ("root", "john" etc) and popular passwords. Sooner or later they will guess correctly. The best solution is to only allow key-based logins and restrict logins to a specific list of user IDs.

Port Forwarding vs DMZ

Some router vendors have misused the term DMZ to mean wildcard port forwarding. Strictly speaking a DMZ is an isolated LAN segment where you place public facing servers. If those servers are taken over by criminals, the criminals still have no access to your internal LAN (where you keep any confidential or valuable data). I would use both port-forwarding an a true DMZ where possible.

Tunelling to SSH without port-forwarding.

The only way is to set up a reverse-tunnel to an external rendezvous point.

share|improve this answer
    
In my case, the "DMZ" forwards all ports, and isolates the machine from the rest of the network. Unfortunately - I do have some confidential data stored on this machine. This is the way it must be - as the whole point of the server is to allow team members access to code files amidst a project. Also, the DMZ is limiting my ability to SSH within the network. What are the security risks to this data, if any, when using chroot'ing and ssh keys? –  FEAST Aug 7 '12 at 20:12
    
If you chroot the SSH users, they can't share files. If that's OK then it is obviously more secure. The risk is that someone will be careless with their private key and that your server will contain an unpatched vulnerability that allows privilege escalation. –  RedGrittyBrick Aug 7 '12 at 20:17
    
When I say chroot I really meant restricting user file access to specific folders per user. Sorry if my terminology is not up to par. How real is the thread of an unpartched vulnerability? Does this depend on the ssh server software...OS security, firewall settings etc etc? How can the vulnerability of keyfiles (that have been passed out) be mitigated? –  FEAST Aug 8 '12 at 0:46
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.