3 ms·

What about an IP whitelist managed on some other website (say in AWS). If you need remote access while you are travelling, you login to that website, which will

by cm2187 2y ago

What about an IP whitelist managed on some other website (say in AWS). If you need remote access while you are travelling, you login to that website, which will add your current IP to the whitelist. The server refreshes its firewall with the new whitelist every 5 minutes. So within 5 minutes you get access. That creates another layer of protection (authentication to the website). I would assume a linux firewall is very hard to bypass so almost as good as not exposing the server to the WAN. And doesn't have all the problems and complexity associated with VPNs, works on any device from anywhere.

themoonisachees 2y ago
Apart from the complexities added by having to build this in the first place, this works, but requires a desktop environment, which is not true of ssh. You could make the argument that this could be an off-the-shelf product you simply install, but then the default port for it because as big of a target as port 22 as soon as it becomes commonplace enough, except you don't have 20+ years of open-source security research in it, and now you're relying on AWS not being now in your region to connect to your servers.
- cm2187 2y ago
  Agree but even if you compromise the white list, you still need to get over ssh's own security, so I see that as adding another lock rather than substituting it, and mostly as a protection against someone scanning the IP address space when a new unpatched zero day surfaces. As for the desktop environment, you can add an API to the website.
rsync 2y ago
There is no reason to bother with any of this when you can just hide behind port knocking.
- cm2187 2y ago
  I didn't know that existed. Seems like a good alternative, thanks. I prefer the whitelist for my own personal usage as it applies to all my servers/VM in one go for all ports. But agree that's a simpler solution if you have a single port+machine to protect.
devman0 2y ago
This is what I do for my own network, but with DNS instead of a website. I have a cron job that reads a DNS A/AAAA record every 5 minutes or so, and updates an ipset referred to by an iptable (now nftable) rule. So I log in to my DNS provider's dash and update the record to my current IP address (I could automate this part too, but I'm lazy)

by cm2187 2y ago

themoonisachees 2y ago

Apart from the complexities added by having to build this in the first place, this works, but requires a desktop environment, which is not true of ssh. You could make the argument that this could be an off-the-shelf product you simply install, but then the default port for it because as big of a target as port 22 as soon as it becomes commonplace enough, except you don't have 20+ years of open-source security research in it, and now you're relying on AWS not being now in your region to connect to your servers.

cm2187 2y ago
Agree but even if you compromise the white list, you still need to get over ssh's own security, so I see that as adding another lock rather than substituting it, and mostly as a protection against someone scanning the IP address space when a new unpatched zero day surfaces. As for the desktop environment, you can add an API to the website.

rsync 2y ago

There is no reason to bother with any of this when you can just hide behind port knocking.

cm2187 2y ago
I didn't know that existed. Seems like a good alternative, thanks. I prefer the whitelist for my own personal usage as it applies to all my servers/VM in one go for all ports. But agree that's a simpler solution if you have a single port+machine to protect.

devman0 2y ago

This is what I do for my own network, but with DNS instead of a website. I have a cron job that reads a DNS A/AAAA record every 5 minutes or so, and updates an ipset referred to by an iptable (now nftable) rule. So I log in to my DNS provider's dash and update the record to my current IP address (I could automate this part too, but I'm lazy)