Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How can I secure my AWS instance's SSH access if I have no static IP?

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 48 posts

Re: Ask HN: How can I secure my AWS instance's SSH access if I have no static IP?

#11

Post by iiix »

You could try using Tailscale. It's a wireguard based mesh VPN. Just set it up on your device, your server, and you're good to go. You can just only allow SSH over Tailscale, without worrying about anybody else trying to get in.

Other alternatives include ZeroTier and Nebula afaik, but I've never tried either.

(Still use SSH keys regardless though.)

Re: Ask HN: How can I secure my AWS instance's SSH access if I have no static IP?

#12

Post by aborsy »

indigodaddy wrote: post #3

Oracle has a generous free tier for OCI instances/VMs, and includes a public IP. You can use that as an ssh bastion/jumphost. Or if don’t want to do business with Oracle, you can find VPS/VM providers who offer tiny instances for $10-12/yr or less. You don’t need much ram for a bastion. 128M ram would do the trick, and even 64M (you’d have to use a stripped down image/distro though). There are even providers who offe…

The same question applies to oracle VPS: how to allow only few IPs?

A compromise of oracle VPS and attacking AWS VPS is same as attacking AWS VPS from internet. If oracle VPS is not compromised, neither will be AWS.

Don’t see the point in this case.

Re: Ask HN: How can I secure my AWS instance's SSH access if I have no static IP?

#13

Post by vero2 »

iiix wrote: post #11

You could try using Tailscale. It's a wireguard based mesh VPN. Just set it up on your device, your server, and you're good to go. You can just only allow SSH over Tailscale, without worrying about anybody else trying to get in. Other alternatives include ZeroTier and Nebula afaik, but I've never tried either. (Still use SSH keys regardless though.)

Zerotier is the easy way around. Also remember to block all ssh access at standard ports.

Re: Ask HN: How can I secure my AWS instance's SSH access if I have no static IP?

#14

Post by dx034 »

gregjor wrote: post #9

If you don't allow password logins so ssh only accepts public/private keypair authentication I think you have a secure setup. Limiting the IPs allowed to connect in the firewall will block the bots that probe port 22 and brute-force attacks, but those aren't going to succeed anyway. As far as I know it's not possible to brute force or otherwise hack ssh with ssl keypair authentication directly. An attacker would need…

Theoretically, a vulnerability in SSH could expose you, but I think those are quite rare. The bigger risk of keeping the server exposed is probably that some application opens another port. But that won't happen on Port 22, so that one could stay open to all.

Re: Ask HN: How can I secure my AWS instance's SSH access if I have no static IP?

#15

Post by dx034 »

indigodaddy wrote: post #3

Oracle has a generous free tier for OCI instances/VMs, and includes a public IP. You can use that as an ssh bastion/jumphost. Or if don’t want to do business with Oracle, you can find VPS/VM providers who offer tiny instances for $10-12/yr or less. You don’t need much ram for a bastion. 128M ram would do the trick, and even 64M (you’d have to use a stripped down image/distro though). There are even providers who offe…

Just be careful with a bastion host that you have a fallback. If anything happens to the bastion host and you don't have access to that IP, your VPS is basically lost. If you use a bastion host, I'd at least have two.

Re: Ask HN: How can I secure my AWS instance's SSH access if I have no static IP?

#16

Post by 1123581321 »

hitsurume wrote: post #8
steffan wrote: post #5

Even if you don’t have a static IP, you can probably restrict to a /24 subnet or maybe /16. Additionally, you can ensure password access is disabled and use ssh keys along with 2FA.

Just curious but what would adding a /24 or /16 do if we're still allowing 0.0.0.0?

You would set it based on the range your ISP tends to assign you, and remove 0.0.0.0 for the ssh port.

Re: Ask HN: How can I secure my AWS instance's SSH access if I have no static IP?

#17

Post by dx034 »

aborsy wrote: post #12
indigodaddy wrote: post #3

Oracle has a generous free tier for OCI instances/VMs, and includes a public IP. You can use that as an ssh bastion/jumphost. Or if don’t want to do business with Oracle, you can find VPS/VM providers who offer tiny instances for $10-12/yr or less. You don’t need much ram for a bastion. 128M ram would do the trick, and even 64M (you’d have to use a stripped down image/distro though). There are even providers who offe…

The same question applies to oracle VPS: how to allow only few IPs? A compromise of oracle VPS and attacking AWS VPS is same as attacking AWS VPS from internet. If oracle VPS is not compromised, neither will be AWS. Don’t see the point in this case.

The advantage is that you only need to harden one instance. The others are safe as they're basically in an "internal" network (firewall blocks all other IPs). With that bastion host, you'd do anything to make it as secure as possible (fail2ban or the like, authkey, block countries you won't access from, etc). For small projects, it's also reasonable to check logs from one host, but not to do so for 10 hosts.

Re: Ask HN: How can I secure my AWS instance's SSH access if I have no static IP?

#18

Post by indigodaddy »

gkrishna wrote: post #4
indigodaddy wrote: post #3

Oracle has a generous free tier for OCI instances/VMs, and includes a public IP. You can use that as an ssh bastion/jumphost. Or if don’t want to do business with Oracle, you can find VPS/VM providers who offer tiny instances for $10-12/yr or less. You don’t need much ram for a bastion. 128M ram would do the trick, and even 64M (you’d have to use a stripped down image/distro though). There are even providers who offe…

I find this very useful. I will setup a bastion. Thank you

On your ssh bastion make sure to at the very least:

- have minimal services running, preferably only ssh

- if you have other services running then use iptables or a firewall frontend to block all incoming ports except for the ones you specifically need/want open

- disable root ssh login

- disable password login (eg use ssh keys and preferably with a passphrase too)

- you can also use something like fail2ban or denyhosts but it’s not really necessary if you’ve also done all the above

- yum or apt update it frequently

- For your ssh connection from the bastion to your AWS instance or any other important ssh destinations from the bastion, use a key with a passphrase for increased security (on the off chance your bastion gets compromised)

- Don’t do anything else too important on your ssh bastion.. eg don’t have any important stuff or work laying around on it or other services/applications running. Just use it as a jumphost only.

Post reply on HN