Hello All,

I like to have the option to grap files off my desktop (Debian Sarge) when I'm away with my Laptop (Slack 10) so I forwarded port 22 to my IP address with my router and allowed SSH conections with my firewall (firestarter). Is this safe? Is there anything that I should make sure that I do in order to make it as safe as possible? I do grab the latest updates every week or so with apt-get and swaret. My passwords are long and complicated.

If this isn't safe, is there a way to do what I want in a safe way?

It's not unhread of to have exploits in sshd.

Now, don't get me wrong, I truely do believe openssh is a solid piece of software, but it really depends on how much security you want.

It's probably safe enough for home use, but it's really all about tastes.

If you want to take an additional step, I would recommend using hosts.allow/deny to limit which ip addresses or subnets can connect to your server.

Of course, if you really want to go over board you can implement port knocking, but that's probably a bit too much.

I would say limiting connections by IP would probably be just enough for home use.

SSH is the safest file transfer protocol. There are a couple of easy things that you should do to make it absolutely secure:

1) Disallow root logins (since that account will be targetted). To do this set a line in /etc/ssh/sshd_config:

PermitRootLogin no

2) Don't allow SSH v.1 connections, only v. 2. The line is:

Protocol 2

3) Use keys rather than passwords: a keyfile includes several hundred characters....

I would say that it is safe. With good firewall protection and limited ssh connections you should be fine. Suscribe to the debian-security mailing list or a simmilar one for ssh to make sure that openssh vulnerabilities don't become a problem.

I would worry too much about getting the latest ssh client with apt-get every week but I'd be more concerned with getting new security updates every time a new update is issued.

Wow, thanks for the quick tips!

I set the Allowroot setting to no in sshd_config--isn't that a bit odd that the default is yes?

Thanks again everyone.

I'd say so.

But isn't still possible to gain root access even tho you have Allowroot setting to NO? I read somewhere that once you're in and have a bash prompt, just do a su to get root privileges?

You would need the root password to su, and hopefully it would be a good one.

It is also possible to disable su.

To clarify the root login thing -

Automated attacks will try to connect to your SSH service with a username that is known to exist on all UNIX systems (root) and try various passwords. The option to stop root logins means that any attempt to login with SSH using the username "root" will automatically fail. You then login with your unique personal account and use "su" or "sudo" for getting root power as you need it.

Using keys and disabling authentication with passwords stops anything that tries to get in by guessing passwords. Easy to setup and it's really cool not to have to type a password every time.

Since you don't know which networks your laptop will be on when you travel, you can't restrict SSH connections to specific IP addresses only, which is a common defence.

Some other options to experiment with are setting a VPN or using one of those "port knocking" utilities.

Good points hob.

I will look into setting up the keys. I've just started to experiment with Networking--I figured I would do i t with my Linux boxes first (since I know that better) and then try to talk to my roomate's WinXP computer with Samba.

Short of a VPN appliance between the box and outside world, SSH is probably the most secure way to connect.