Ask HN: How can I secure my AWS instance's SSH access if I have no static IP?

When I try to create a new instance on AWS, I get a warning:

`Rules with source of 0.0.0.0/0 allow all IP addresses to access your instance. We recommend setting security group rules to allow access from known IP addresses only.`

What are alternative security measures that I can apply to protect my servers?

Oracle has a generous free tier for OCI instances/VMs, and includes a public IP. You can use that as an ssh bastion/jumphost.

Or if don’t want to do business with Oracle, you can find VPS/VM providers who offer tiny instances for $10-12/yr or less. You don’t need much ram for a bastion. 128M ram would do the trick, and even 64M (you’d have to use a stripped down image/distro though).

There are even providers who offer instances for even less $ and only give you an ipv6 range + NAT IPv4 address with a small port range. This would also work perfectly fine as a bastion.

Even if you don’t have a static IP, you can probably restrict to a /24 subnet or maybe /16.

Additionally, you can ensure password access is disabled and use ssh keys along with 2FA.

Disallow password logins, change ssh port, change/hide sshd identity information or configure port knocking.

If you don't allow password logins so ssh only accepts public/private keypair authentication I think you have a secure setup. Limiting the IPs allowed to connect in the firewall will block the bots that probe port 22 and brute-force attacks, but those aren't going to succeed anyway. As far as I know it's not possible to brute force or otherwise hack ssh with ssl keypair authentication directly. An attacker would need access to your ssl private key. The ssh protocol resists MITM attacks as well.

If anyone knows about actual working attacks on ssh servers that don't allow password authentication I'd like to know about it. I don't mean state-level attackers who would probably hack into your laptop or strong-arm the hosting provider.