Re:FritzFrog: A New Generation of Peer-to-Peer Botnets
by manishsharan on Tuesday August 25, 2020 @02:59PM
(#24274748)
Could you comment on my way of accessing my servers on AWS:
My server are on VPC and no public ssh is allowed (nothing is open besides 443). When I want to login to my server , I run a script to modify security. (I have disabled ssh password logins and ssh is running on non standard port). And when I am done with task, I plug the hole in security group with another batch code. I am worried that I may be not exposing my servers with my practices.
[ Parent
| on HN ]
Re:FritzFrog: A New Generation of Peer-to-Peer Botnets
by chewmieser on Tuesday August 25, 2020 @03:37PM
(#24275151)
No op, but your practice is probably fine. More ideally, SSH would be locked down to your public IP address only. If you're already scripting this, you could just do a curl request to one of the many "what is my ip" services and set that instead of 0.0.0.0/0 as the security group IP address.
We also use bastion hosts. They're whitelisted for key-based SSH only access for our public IP addresses. We can jump around to other servers once we login to that one, but our externally facing servers never advertise anything other their base service (:443 or whatever is running on them).
I also use them with my personal servers and just leave them shut off when I'm not actively using them. This keeps costs down, but more importantly it permanently blocks off SSH access unless I'm specifically in need of it.
Re:FritzFrog: A New Generation of Peer-to-Peer Botnets
by ajawee on Tuesday August 25, 2020 @03:43PM
(#24275215)
Did you try port knocking https://wiki.archlinux.org/index.php/Port_knocking