0

For security reasons I want to turn off SSH when I don't use it and turn it on again via a VNC connection as I can connect to my web server remotely over the Digitalocean control panel's console instead, and turn on SSH that way.

Is below the best way of doing it?

sudo stop ssh
sudo ufw deny 22

And turn on SSH via VNC

sudo ufw allow 22/tcp
sudo start ssh

Or should I use any of the below variants?

sudo service ssh stop
sudo systemctl stop ssh
sudo /etc/init.d/ssh stop

I'm on a UBUNTU 16.04 LTS server. And I want to disable SSH for all users, not only for root.

I have already taken all security measures which I have listed here: https://askubuntu.com/questions/880316/more-secure-ubuntu-16-04-web-server-for-wordpress And the VNC console is behind Digitalocean control panel accessed only with 2-factor auth. I cannot disable this console as it's part of the Digitalocean control panel.

Improve this question
5
  • 2
    Please don't cross post on multiple sites: unix.stackexchange.com/q/342769/85039
    – Sergiy Kolodyazhnyy
    Feb 6, 2017 at 1:54
  • the post was closed on U&L so we should leave it open here imho (the answers here have been upvoted)
    – Zanna ♦
    Feb 6, 2017 at 12:34
  • @Zanna But I only got relevant answers at U&L. Here i only got security related answers which I already had implemented ( askubuntu.com/questions/880316/… ).
    – Gabriel
    Feb 6, 2017 at 14:12
  • Oh. Well I can't help to reopen your post on U&L as I have <3k there. If you already got answers perhaps it doesn't matter. And whether we close this here or not now doesn't matter either; it is answered and closing will not remove the content. I'd be in favour of leaving this question open here, but if you (Gabriel) want to close it then you can flag for mod attention. I don't know whether that would help your case or not as regards reopening on U&L if that is something you want to pursue.
    – Zanna ♦
    Feb 6, 2017 at 14:17
  • OK @Zanna As you said it doesn't really matter as i l already got the answer at U&L...
    – Gabriel
    Feb 6, 2017 at 14:29

3 Answers 3

Reset to default
5

Honestly, "for security reasons" it makes no sense to close port 22 but leave 5900 open. A port is a port. So let's look at the service on the other side. SSH can support 2 factor and public key auth. VNC had (may still have) and 8 character password limit. Edit: Furthermore, VNC has no encryption.

Move ssh to a different port, 4521 for example, and enable two-factor auth. That's security.

Improve this answer
2
  • By default VNC uses no encryption. Why not make your ssh login work only with ssh keys ? Using only ssh keys give me peace of mind since brute-force attacks won't work for intruders in that case.
    – albert j
    Feb 6, 2017 at 2:49
  • Also, if you're worried about security you should run VNC over an SSH tunnel. Another option is to enable VNC on demand via SSH, because the former is less secure than the latter (assuming a sane setup).
    – David Foerster
    Feb 6, 2017 at 8:59
0

Move your ssh service to a different port and use key based authentication to make it more secure.

Keep track of unauthorized access attempts on ssh port and ban those IP addresses.

Improve this answer
0

as others have mentioned, vnc is far less secure; you'd do better to tunnel your vnc session through ssh. (google ssh tunnels, in short from your starting point ssh -L 5901:localhost:5901 you@remotemachine ; vncviewer localhost:1 )

using passworded (or even to a lesser degree unpassworded ssh keys will help improve security into ssh. mfa is probably a bit too much for most home users, but is possible and does increase security.

I don't agree with the notion of moving ssh to a new port - that's not security, it's obfuscation, and not very good obfuscation at that.

Improve this answer
2
  • The OP asks how to disable it. Not about security. The U&L post in comments is a better answer.\
    – VidathD
    Jun 23, 2020 at 18:46
  • he also says 'for security reasons'. if someone asks 'what's the best hammer to buy, I need to replace my internal hdd with an ssd', I'm equally likely to tangent off more to the use of screwdrivers than merits of hammers.
    – frustrated.
    Jun 30, 2020 at 13:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .