I'm lazy and just manually update my IP in the security group. It's not like the server shuts down when my home IP changes.
Ask HN: How can I secure my AWS instance's SSH access if I have no static IP?
31–40 of 48 posts
Re: Ask HN: How can I secure my AWS instance's SSH access if I have no static IP?
#32ip=$(curl https://api.ipify.org)
tag_name="tmpip"
tag_time=$(date -u '+%Y-%m-%dT%H:%M:%SZ')
aws ec2 authorize-security-group-ingress --group-id sg-86169665d2453e4 --protocol tcp --port 22 --cidr "$ip/32" --tag-specifications "ResourceType=security-group-rule,Tags=[{Key=Name,Value=${tag_name}},{Key=added,Value=${tag_time}}]"
The tag enables replacing the existing rule via tag Name, the further you go the easier it is to use the API SDKs
Re: Ask HN: How can I secure my AWS instance's SSH access if I have no static IP?
#33An AWS specific solution would be to use Systems Manager Sessions Manager to provide access into the instances and disallow all public access to the instances. No SSH. Identity is provided by IAM. As long as you use AWS cli and have configured it to login with your IAM creds, you can simply get a session via SSM. Added bonus is the ability to easily get an audit log in cloudwatch/S3. And no SSH keys/Linux user accounts to manage.
We use this for all our bastion hosts.
Re: Ask HN: How can I secure my AWS instance's SSH access if I have no static IP?
#34Definitely use SSM, it takes care of everything for you and you don't need a bastion.
Re: Ask HN: How can I secure my AWS instance's SSH access if I have no static IP?
#35If you don't allow password logins so ssh only accepts public/private keypair authentication I think you have a secure setup. Limiting the IPs allowed to connect in the firewall will block the bots that probe port 22 and brute-force attacks, but those aren't going to succeed anyway. As far as I know it's not possible to brute force or otherwise hack ssh with ssl keypair authentication directly. An attacker would need…
OpenSSH is next to Wireguard in security, and, in my view, not too far behind (roughly similar to OpenVPN).
I don’t think state level actors can compromise it, if properly configured.
It’s far easier to hack the end point and steal the keys.
Re: Ask HN: How can I secure my AWS instance's SSH access if I have no static IP?
#36Earlier quoted context omitted.
Is changing SSH port really necessary? If your SSH is vulnerable, attackers will find the Port for it.
Surprisingly, just changing the port is highly effective. Scanning every ipv4 address still chews bandwidth even for just a handful of ports. Add ipv6 into the mix and it's straight up infeasible to scan for even ONE port on every host! Port knocking + key auth + non-default port is pretty damn good security, even against zero days in SSH.
So the solution is just to use IPV6 only SSH? I'm serious, you could use an ip just for SSH, making it very hard for anyone even to get the server address. And it's not that hard to be able to access ipv6 addresses.
Re: Ask HN: How can I secure my AWS instance's SSH access if I have no static IP?
#37Earlier quoted context omitted.
Zerotier is the easy way around. Also remember to block all ssh access at standard ports.
That implies running SSH on another, non-standard port makes it safer -- when a simple port scan would reveal it. It's a classic security through obscurity fallacy, IMHO,
I did not say/imply that the user should implement a ONLY non-standard port as security.
Sure " simple port scan would reveal it" - but for those other script kiddes that do not do have it prevents it. And BTW, every bit helps of security helps. zerotier at an alternative port is slightly better than port 22.
Re: Ask HN: How can I secure my AWS instance's SSH access if I have no static IP?
#38Earlier quoted context omitted.
You would set it based on the range your ISP tends to assign you, and remove 0.0.0.0 for the ssh port.
Unfortunately. I have seen some ISPs DHCP servers assign IPs with no particular subnet(s). Could be a case here as well.
That’d be frustrating, not just for this. I’d probably be looking into a solution like Tailscale to tunnel out. Or just develop a gnarled security rule list full of rich history. :)
Re: Ask HN: How can I secure my AWS instance's SSH access if I have no static IP?
#39Earlier quoted context omitted.
I find this very useful. I will setup a bastion. Thank you
On your ssh bastion make sure to at the very least: - have minimal services running, preferably only ssh - if you have other services running then use iptables or a firewall frontend to block all incoming ports except for the ones you specifically need/want open - disable root ssh login - disable password login (eg use ssh keys and preferably with a passphrase too) - you can also use something like fail2ban or denyho…
is there any way to just tunnel the ssh traffic trough the bastion but let the ssh authentication be done from my computer instead?
that way i would not need to keep the keys in the bastion server at all.
Re: Ask HN: How can I secure my AWS instance's SSH access if I have no static IP?
#40ip=$(curl https://api.ipify.org ) tag_name="tmpip" tag_time=$(date -u '+%Y-%m-%dT%H:%M:%SZ') aws ec2 authorize-security-group-ingress --group-id sg-86169665d2453e4 --protocol tcp --port 22 --cidr "$ip/32" --tag-specifications "ResourceType=security-group-rule,Tags=[{Key=Name,Value=${tag_name}},{Key=added,Value=${tag_time}}]" The tag enables replacing the existing rule via tag Name, the further you go the easier it is…
This is really a creative solution with no extra costs!