I have a CentOS home server that I use for various things, which sits on my home network behind my router. Normally when I want to do something remotely I will VPN in (my router has a built-in OpenVPN server function that I use) and work from there.

Anyway I was thinking I might just open port 22 to my server so I don't have to connect with a VPN client first. I have password logins disabled and connect using an ssh key instead.

Would it be particularly dangerous for me to open port 22 for SSH connections with my setup as I've described? I know it would be more dangerous, but I'm not exactly the NSA in that there's not a horde of people just itching to get inside my network, so I'm just curious about if the extra risk would be substantial.

migrated from serverfault.com Jan 30 '15 at 18:09

This question came from our site for system and network administrators.

Would it be particularly dangerous for me to open port 22 for SSH connections with my setup as I've described?

No, that's just fine. As long as password auth is disabled, don't worry about it.

Some people prefer to run SSH on a non-standard port. This is not so much a security measure as it is a way to reduce noise in your auth logs, as the vast majority of ssh brute-force scripts only try to connect to the default port.

  • 3
    If you use password auth make sure you run fail2ban or DenyHosts. – HTTP500 Jan 30 '15 at 18:30
  • @HTTP500 There is really no good reason for anyone to use password auth anymore. Thanks to organizations like github and AWS pushing key auth, getting keys generated and deploying them is more and more becoming computing 101 type material. With the prevalence of distributed slow-burn brute-force bots, the tools you suggest will not do a thing to help the situation. – EEAA Jan 30 '15 at 18:33
  • 1
    @EEAA, I often need to boot a system at a site with a live CD, such as a rescue CD, where I may want to pull some tools from a server to use on the system or scp suspected malware files to a system at another location for further analysis later. I don't want to store any keys on the system at the site, so password auth is useful. What I see when I look at my logs is not distributed attacks from hundreds or thousands of systems, but repeated login attempts with a group of userids paired with many passwords from a few IP adresses, which can be banned with tools like fail2ban. – moonpoint Jan 30 '15 at 21:03
  • No reason to use password auth? Don't you have to trust the host you are connecting from? I would never store ssh authorization keys on a machine I didn't control, as anybody that took control of that machine would then be able to trivially log in to my machine. – Michael Jan 31 '15 at 4:07
  • 1
    @Michael Ideally? Some form of hardware token (usually via USB for portability). The private key would be stored on the token and never directly exposed - only used to sign the auth requests. Or other multi-factor auth - if you can get the SSH server to send you an SMS for confirmation, that would be much more secure. – Bob Jan 31 '15 at 7:39

As long as your CentOS system is up-to-date on patches, i.e., you don't have a fairly old version of sshd running on the system, you should be fine. In regards to your comment that "there's not a horde of people just itching to get inside my network", if you check connection attempts to port 22 you might be surprised. If you run SSH on the default port of 22, you should expect that every day there will be people throughout the world trying to gain access to your system via SSH. I also have a home CentOS server and see thousands of attempts every day; about 14,000 attempts from 109 unique IP addresses in the last 12 hours. When I check /var/log/secure, most of the attempts are usually for a userid of root or admin, though I see attempted SSH logins for lots of other userids as well.

When I also ran an FTP server on the system, I would monitor the userids and passwords used via KRIPP and could see dictionary attacks every day where name dictionaries were used for userids and paired with English language dictionaries and commonly used passwords for passwords. Those occurred on a daily basis and I would observe as many as half a dozen systems in various parts of the world, e.g., Brazil, China, the U.S., etc., conducting such attacks at once.

You aren't allowing password logins, so don't need to worry about any accounts on the system having a weak password providing an entry point to the system for an attacker, but you still should be aware that there are thousands of systems out on the Internet scanning vast IP ranges searching for a vulnerable system. Sometimes they are looking for a system with financial or other information they can exploit and at other times it is for vulnerable systems that can be used as a launchpad to attack other systems while concealing the true origination point for whatever nefarious deeds the attacker has planned.

If you have anything to secure (which seems logical, considering you have a key based SSH setup and VPN configured), secure it to the best of your ability. Changing the port cuts down on automated attacks, so why even take the chance when it is so easy to change and so easy to specify when connecting? I would pick one or the other (to reduce the vectors of attack), and use every possible means to secure the connection you decide to stay with. Both offer similar functionality, so which one is easier to use?

For a home setup, I would prefer SSH to a machine in the network that I can branch tunnels out from. As far as security goes, I also put more faith in SSH on a CentOS box than OpenVPN on a retail router. Also you wouldn't have to worry about your home network ever being in the same subnet as where you are connecting from, a common VPN issue.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.