Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How can I secure my AWS instance's SSH access if I have no static IP?

news.ycombinator.com

Post reply on HN
Print view View original

41–48 of 48 posts

Re: Ask HN: How can I secure my AWS instance's SSH access if I have no static IP?

#41

Post by gkrishna »

gioazzi wrote: post #29
JMS2021 wrote: post #20

SSM

+1 - AWS Systems Manager Session Manager [1] is the future! (although it does have a ridiculous name...) It's free, and configuring its agent can enable you to do other useful maintenance tasks through it. Assuming you're using Amazon Linux 2 as your AMI, it's just as simple as assigning a instance profile with the right permissions (you can use the managed AmazonSSMManagedInstanceCore policy [2]). And you'll then be…

I will be going with this solution as it is free and simple. Thank you for briefing on this!

Re: Ask HN: How can I secure my AWS instance's SSH access if I have no static IP?

#42

Post by gkrishna »

dx034 wrote: post #15
indigodaddy wrote: post #3

Oracle has a generous free tier for OCI instances/VMs, and includes a public IP. You can use that as an ssh bastion/jumphost. Or if don’t want to do business with Oracle, you can find VPS/VM providers who offer tiny instances for $10-12/yr or less. You don’t need much ram for a bastion. 128M ram would do the trick, and even 64M (you’d have to use a stripped down image/distro though). There are even providers who offe…

Just be careful with a bastion host that you have a fallback. If anything happens to the bastion host and you don't have access to that IP, your VPS is basically lost. If you use a bastion host, I'd at least have two.

This shouldn't be a big problem as you can use configuration management such Ansible to get around. In case of bastion loss you can simply create a new instance and run the script to recover your instances.

Re: Ask HN: How can I secure my AWS instance's SSH access if I have no static IP?

#43

Post by indigodaddy »

tmottabr wrote: post #39
indigodaddy wrote: post #18

Earlier quoted context omitted.

On your ssh bastion make sure to at the very least: - have minimal services running, preferably only ssh - if you have other services running then use iptables or a firewall frontend to block all incoming ports except for the ones you specifically need/want open - disable root ssh login - disable password login (eg use ssh keys and preferably with a passphrase too) - you can also use something like fail2ban or denyho…

is there any way to just tunnel the ssh traffic trough the bastion but let the ssh authentication be done from my computer instead? that way i would not need to keep the keys in the bastion server at all.

Yes, it’s fairly trivial with ProxyCommand or ProxyJump switch:

https://www.redhat.com/sysadmin/ssh-proxy-bastion-proxyjump

Re: Ask HN: How can I secure my AWS instance's SSH access if I have no static IP?

#44

Post by indigodaddy »

gkrishna wrote: post #4
indigodaddy wrote: post #3

Oracle has a generous free tier for OCI instances/VMs, and includes a public IP. You can use that as an ssh bastion/jumphost. Or if don’t want to do business with Oracle, you can find VPS/VM providers who offer tiny instances for $10-12/yr or less. You don’t need much ram for a bastion. 128M ram would do the trick, and even 64M (you’d have to use a stripped down image/distro though). There are even providers who offe…

I find this very useful. I will setup a bastion. Thank you

I have a BuyVM.net 3.50/mo KVM slice that has been idling for maybe a year (yeah I know I need to get on it..), so I can transfer that to you if you want. BuyVM has been around forever and they are awesome, but are almost always sold out (just checked and they are).

If you want to reply with your contact details I can see if I can get that going and you can take over the vps if you want..

Other options for providers:

- netcup.eu (I use them.. they don’t have small instances but they are super great prices for the sizes they offer)

- Hetzner Cloud (never used but heard great things and their prices are very low)

- OVHCloud (I have dedi servers from Kimsufi and SoYouStart which have been great— OVH is the parent company)

- prgmr.com - these guys have been around since the very beginning of vps hosting. They wrote the book (quite literally) on Xen ( https://www.amazon.com/Book-Xen-Practical-System-Administrat... )

- low $ NAT VPS options:

https://clients.inceptionhosting.com/cart.php?gid=13

https://hosting.gullo.me/pricing

- free ipv6-only vps (or $1/mo to add an ipv4):

https://www.euserv.com/en/virtual-private-server/root-vserve...

- An informative resource: https://lowendbox.com/blog/free-vps-providers/

Re: Ask HN: How can I secure my AWS instance's SSH access if I have no static IP?

#45

Post by indigodaddy »

aborsy wrote: post #27
indigodaddy wrote: post #26

Earlier quoted context omitted.

If his AWS instance is running internet facing applications and services, then it makes sense to have the AWS firewall lock down port 22 to a single IP or two (eg your bastions), and also have that AWS firewall only allow all access to those specific internet facing ports for any relevant applications. Yes you can and should also harden at the OS level. But it’s smart to utilize AWS’ security as well as much as possi…

Yes. Thank you for expanding my answer :) Even better, no open port anywhere is actually needed.

I’m definitely not following you..

Re: Ask HN: How can I secure my AWS instance's SSH access if I have no static IP?

#46

Post by digianarchist »

reacharavindh wrote: post #33

An AWS specific solution would be to use Systems Manager Sessions Manager to provide access into the instances and disallow all public access to the instances. No SSH. Identity is provided by IAM. As long as you use AWS cli and have configured it to login with your IAM creds, you can simply get a session via SSM. Added bonus is the ability to easily get an audit log in cloudwatch/S3. And no SSH keys/Linux user accoun…

You need the agent running too but I believe this is the most secure way.

Re: Ask HN: How can I secure my AWS instance's SSH access if I have no static IP?

#48

Post by tragictrash »

Use ssh pubkey auth and disable password. Set up a totp challenge after pubkey auth. Switch the default ssh port. Restrict ssh login to 1 user who's name isn't 'root' or 'ubuntu' or something everyone would look for. Wrap that in wireguard, and have ssh only listen on the wireguard interface if your worried, but that's an unnecessary extra step.
Post reply on HN