How do I best allow for an ssh access to my home desktop,
w/ minimum security risk?

1) what router would you recommend?
2) open port 33243 for example at the router and forward it to sshd port?
3) stronger username/password..

What else? Am I doing something wrong/ missing something?

Thanks,
Nick

Cynick,

Make sure you configure the ssh server to only except connections via sshv2. By moving it to a different port that will help you as well. Another idea is only allow the user id or id's you want to have access. In your sshd.conf you can put in either users or groups to have access.

Change your password frequently and make it a strong password. You can also look into using shared keys. However, I am not sure how to implement that.

Another option, if you always use the same computer for remote connection, is to allow ssh access to the specific ip address of that workstation, so that it makes it all that more difficult for someone to access your machine via ssh ... unless they are cracking from your office.

* make sure root login is disabled ("PermitRootLogin no" in sshd_config)
* if possible, disable passwords altogether and only use public keys
* install DenyHosts; packages exist on most distros

Take a look at the "man sshd_config" man page. The entries for AllowUsers and DenyUsers can be used to control who and from where a user can log in. There are also AllowGroups and DenyGroups entries which can be used if there are many users who are allowed to log in. You could make a new group and use it to control access, by only allowing members of the group to log in. This makes it easy to control who can and can't log in via sshy by controlling who is a member of this group. This config uses the "*" and "?" wild cards. In the very least, the system users should be listed in DenyUsers

I'm not certain if the UsePAM option would affect this access control.