37

Title continuation would be “while having limited knowledge of Internet security”.

I have recently set up a small server with a low end computer running debian with the aim to use it as a personal git repository. I have enabled ssh and was quite surprised at the promptness at which it suffered from brute force attacks and the like. Then I read that this is quite common and learned about basic security measures to ward off these attacks (lots of questions and duplicates on serverfault deal with it, see for instance this one or this one).

But now I am wondering if all this is worth the effort. I decided to set up my own server mostly for fun : I could just rely on third party solutions such as those offered by gitbucket.org, bettercodes.org, etc. While part of the fun is about learning about Internet security, I have not enough time to dedicate to it to become an expert and be almost certain that I took the correct prevention measures.

In order to decide if I will continue to play with this toy project, I would like to know what I really risk in doing so. For instance, in what extent are the other computers connected to my network threaten as well? Some of these computer are used by people with even lesser knowledge than mine running Windows.

What is the probability that I get into real trouble if I follow basic guidelines such as strong password, disabled root access for ssh, non standard port for ssh and possibly disabling password login and using one of fail2ban, denyhosts or iptables rules?

Put another way, is there some big bad wolves I should fear or is it all mostly about shooing away script kiddies?

3
  • I think you hit the nail on the head when you mentioned that you don't have the time or inclination to become an expert in $TECHNOLOGY security; this is the primary reason to use a hosted solution. The only other common argument in evaluating in-house vs hosting is the cost. Since github and the like are free, you're essentially giving up your personal time just to gain the knowledge of how to run a git repo. We can't tell you what you should be doing with your personal time, but in a professional situation this would make no sense. (caveat emptor: complicated situations have more variables).
    – Chris S
    Aug 26, 2013 at 14:09
  • 1
    If you decide to run your own server, also add to your todo list regular checking for updates and security vulnerabilities for every service you run. Just setting it up is not enough.
    – week
    Aug 26, 2013 at 14:18
  • Two words: public keys, as @Stephane put it. Disable keyboard-interactive authentication and use only pubkey authentication.
    – kostix
    Aug 26, 2013 at 16:20

5 Answers 5

19

IMO SSH is one of the safest things to have listen on the open internet. If you're really concerned have it listen on a non-standard high end port. I'd still have a (device level) firewall between your box and the actual Internet and just use port forwarding for SSH but that's a precaution against other services. SSH itself is pretty damn solid.

I have had people hit my home SSH server occasionally (open to Time Warner Cable). Never had an actual impact.

Some additional things you can do to make SSH safer are prevent repeated attempts from the same IP address for a home machine something like

MaxStartups 2:30:10

in /etc/ssh/sshd_config which will restrict how many connections can be created in a row before logging in successfully.

9
  • My Internet service provider provides a firewall whose parameters I saw when opening a port for ssh. Is it what you refer to?
    – M. Toya
    Aug 26, 2013 at 13:05
  • 2
    Could be, some ISPs give you a dumb device, some a router with a built in firewall. I'm just saying that it's NEVER a good idea to put a general purpose OS directly on the Internet no matter what precautions you take. You want some sort of hardware device (or something like DD-WRT) between you and the nasty. Aug 26, 2013 at 13:20
  • 1
    Set up public key authentication as mentioned in another answer, and TURN OFF ChallengeResponseAuthentication and PasswordAuthentication in /etc/ssh/sshd_config. Aug 27, 2013 at 8:05
  • I know this is a stupid question but do I need to buy a domain to access my server (via ssh or browser) from the internet? Apr 15, 2015 at 3:40
  • @TheRookierLearner - no, you can use the IP address your ISP provides you. However, depending on your home network's configuration, can be shared through all your devices by something called PNAT (most folks just call it NAT). If you are like the majority of folks you'll need to figure out the "NATed" IP of the specific device you want to access from the internet (just ifconfig/ipconfig on the system, it will be a 10.x.x.x, 172.16.x.x. or 192.168.x.x address see RFC 1918 for more than you care about these numbers) and then tell your router to "port forward" or "DMZ" port 22. Apr 15, 2015 at 14:14
13

Setting up a public key authentication system with SSH is really trivial and takes about 5 minutes to setup.

If you force all SSH connection to use it, then it'll make your system pretty much as resilient as you can hope to without investing a LOT into security infrastructure. Frankly, it's so simple and effective (as long as you don't have 200 accounts - then it gets messy) that not using it should be a public offense.

1
  • 6
    To force SSH connections to use public key authentication after you've set it up, make sure you TURN OFF ChallengeResponseAuthentication and PasswordAuthentication in /etc/ssh/sshd_config. I forgot this once, much to my regret (only once, and never again). Aug 27, 2013 at 8:07
11

I also run a personal git server that's open to the world on SSH, and I also have the same brute-force issues as you, so I can sympathise with your situation.

TheFiddlerWins has already addresses the main security implications of having SSH open on a publicly-accessible IP, but best tool IMO in response to brute-force attempts is Fail2Ban - software that monitors your authentication log files, detects intrusion attempts and adds firewall rules to the machine's local iptables firewall. You can configure both how many attempts before a ban and also the length of the ban (my default is 10 days).

1
  • As my comment on previous post stated, that's what my NAS uses at home, and after a couple of month, the amount of attemps has been significally lowered.
    – mveroone
    Aug 26, 2013 at 14:33
2

Another way to handle this is to set up a VPN. Rather than connecting directly to SSH ports on your home server, you connect to the VPN first, then run all your traffic over the encrypted, secure connection.

The ideal way to handle this is with a firewall that incorporates a VPN Endpoint, but you can also set up a Windows computer to act as a VPN server.

Here's an example:

http://www.howtogeek.com/135996/

Now keep in mind that a proper security configuration would involve a public (or semi-public) computer that's isolated from your internal network. A web server, or any computer hosting publicly available services, should be outside of your home or office's secure network. You would use 2 routers to create a safe zone, or a DMZ, between you and the Internet.

This way, if your server is hacked, it can't be used as a vector to attack your other computers.

So the setup would look like this:

DMZ Configuration

1
  • Sorry about the small image... I can't figure out how to edit my post.
    – TomXP411
    Dec 5, 2013 at 22:03
2

The answers are very good, I would only recommend two things:

  • Consider access only by key authentication system
  • Use Denyhosts: It will ban hosts attempting to access your server with invalid auth

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .