0

For security reasons I want to turn off SSH when I don't use it and turn it on again via a VNC connection as I can connect to my web server remotely over the Digitalocean control panel's console instead, and turn on SSH that way.

Is below the best way of doing it?

sudo stop ssh
sudo ufw deny 22

And turn on SSH via VNC

sudo ufw allow 22/tcp
sudo start ssh 

Or should I use any of the below variants?

sudo service ssh stop
sudo systemctl stop ssh
sudo /etc/init.d/ssh stop

I'm on a UBUNTU 16.04 LTS server. And I want to disable SSH for all users, not only for root.

I have already taken all security measures which I have listed here: https://askubuntu.com/questions/880316/more-secure-ubuntu-16-04-web-server-for-wordpress And the VNC console is behind Digitalocean control panel accessed only with 2-factor auth. I cannot disable this console as it's part of the Digitalocean control panel.

  • 2
    Please don't cross post on multiple sites: unix.stackexchange.com/q/342769/85039 – Sergiy Kolodyazhnyy Feb 6 '17 at 1:54
  • the post was closed on U&L so we should leave it open here imho (the answers here have been upvoted) – Zanna Feb 6 '17 at 12:34
  • @Zanna But I only got relevant answers at U&L. Here i only got security related answers which I already had implemented ( askubuntu.com/questions/880316/… ). – Gabriel Feb 6 '17 at 14:12
  • Oh. Well I can't help to reopen your post on U&L as I have <3k there. If you already got answers perhaps it doesn't matter. And whether we close this here or not now doesn't matter either; it is answered and closing will not remove the content. I'd be in favour of leaving this question open here, but if you (Gabriel) want to close it then you can flag for mod attention. I don't know whether that would help your case or not as regards reopening on U&L if that is something you want to pursue. – Zanna Feb 6 '17 at 14:17
  • OK @Zanna As you said it doesn't really matter as i l already got the answer at U&L... – Gabriel Feb 6 '17 at 14:29
5

Honestly, "for security reasons" it makes no sense to close port 22 but leave 5900 open. A port is a port. So let's look at the service on the other side. SSH can support 2 factor and public key auth. VNC had (may still have) and 8 character password limit. Edit: Furthermore, VNC has no encryption.

Move ssh to a different port, 4521 for example, and enable two-factor auth. That's security.

  • By default VNC uses no encryption. Why not make your ssh login work only with ssh keys ? Using only ssh keys give me peace of mind since brute-force attacks won't work for intruders in that case. – albert j Feb 6 '17 at 2:49
  • Also, if you're worried about security you should run VNC over an SSH tunnel. Another option is to enable VNC on demand via SSH, because the former is less secure than the latter (assuming a sane setup). – David Foerster Feb 6 '17 at 8:59
0

Move your ssh service to a different port and use key based authentication to make it more secure.

Keep track of unauthorized access attempts on ssh port and ban those IP addresses.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.