Enable port change for SSH access

Adam

I don't personally think it adds much security to change the SSH port. It's much better to disable password authentication, either for root or for all users.

However the ability to run Enhance with a custom SSH port is a very popular feature request and it will be added in the very near future. At the moment it will disrupt website cloning and website transfers between servers as these are performed over SSH as the website user (for security). If you're not using those features it's fine to change the SSH port now.

JohnB

Adam I don't personally think it adds much security to change the SSH port. It's much better to disable password authentication, either for root or for all users.

It doesn't add "security" per se because someone can portscan to find it and a bot isn't going to bruteforce a half decent SSH configuration on port 22.

However its nice to have far fewer log entries from bots attempting on port 22 and less firewall rules for fail2ban.

If suddenly you are getting attacks hitting a high number port, the odds are its not just a driveby bot. This can be useful info. This is why I would like it. When SSH is on port 22 you can't easily seperate random bots vs a more dedicated attack. An unlikely port number makes it really obvious because very few driveby bots will portscan up to high numbers. It takes to long if you want to avoid getting blocked and odd port number likely means the server is too secure for the bot to exploit.

xyzulu

@JohnB Have you disabled password authentication at least for ssh?

JohnB

xyzulu I was never saying to change the SSH port and not follow security standards lol. I'm just saying changing the port has real world positives and no real negatives.

In my case I don't have customers who want or know what SSH access is so the port is only open to my IP and CP. If that changes though I would want to change the port.

xyzulu

What about disabling password logins to ssh? This is a huge security step

JohnB

xyzulu Again...never said it wasn't important.

xyzulu

It's more important than the port change. Anyway.. I'm starting to sound like I am arguing.. I'll leave this thread now.

JohnB

xyzulu Anyway.. I'm starting to sound like I am arguing..

Same. I may have taken your comment the wrong way and I think you misunderstood my original point in my reply to Adam. To be clear changing the port does not, in any way, INCREASE security. Not at all. If you can only do two things obviously disable password login.

Changing the port DOES greatly reduce bot bruteforcing which reduces log entries and makes it much easier to identify a more targeted attack (because random bots won't port scan to high number ports generally.

You might have a secure bunker with a reinforced door that cannot be breached. It still might useful to move that door somewhere hidden instead of on display for people passing by. Instead of 100 randoms hitting the door its peace and quiet (no logs) until someone more dedicated comes along.

xyzulu

.. but disabling password authentication is like removing the lock/keyhole on the door. People will not bother brute forcing as there is no where to "insert the key"...

Anyway.. changing the ssh port is a reasonable request.. just not one that I think is particularly important. And, the OP said "for security" which I don't agree is a valid reason to change SSH ports. But, that's just me..

No offence or argument intended.

gozen

Changing the SSH port doesn't necessarily enhance security, but it does reduce notification emails. Securing SSH by disabling passwords and using SSH keys is indeed a more secure approach.

Taavi

SSH should be ip whitelist based.

Adam

Taavi SSH should be ip whitelist based.

You can do this with ufw. Just allow your IP ufw allow from 8.8.8.8 then ufw delete allow ssh. Replace 8.8.8.8 with your IP. This is only really suitable if you are self-hosting or if you don't want to provide SSH access to customers as they would otherwise need to contact you to whitelist them every time their IP changes.

nqnoc

Adam

Hi
Whitelist SSH with UFW seems a great solution! In my case I have a fixed IP at work and 2 personal VPNs, so I have 1 static IP when at office and 2 Static IPs when on the road.

So just to be clear, if I want to allow SSH to Enhance server just from my own 3 IPs I have to run the following SSH commands:

ufw allow from 1.1.1.1
ufw allow from 2.2.2.2
ufw allow from 3.3.3.3
ufw delete allow ssh

Is this correct? And these settings will cause no issues/interferance with Enhance Cluster and will persist even after OS and Enhance updates?
Thanks

Adam

It will persist, at least until we release the official firewall manager feature. If you want to migrate websites or clone websites to this server, you should also allow the IPs of the other servers within your cluster.

JohnB

Adam official firewall manager feature. I

When this feature is live would it be possible to have a feature where users can whitelist their IP from the ssh login info screen? It would be good for cases where customers want to use password auth without risking bots infecting their container. Same for FTP actually.

Maybe SSH user info page just lists the IPs whitelisted for port 22 with an easy add button that prefills their current IP.
For FTP it would be the same just IPs whitelisted for port 21.

cristianuibar

Any news on custom SSH port? One of our providers only use a custom port for SSH and this would be helpful.