Re: ssh brute force attacks

Hi Ed,

> We recently started using OpenVPN with certificates.  I'm working on  
> adding a password so it takes both a certificate and a password to  
> connect a remote machine to the private network.

I've been using OpenVPN for years, and have found it extremely reliable.   
In fact, not only do I use it for external access, but I use it even  
within the LAN, so that all services are accessible only through OpenVPN  
(even ssh, dns, nfs, samba, email, apache, cups).  Laptops keep their same  
VPN IP addresses wherever they connect from, making DNS administration  
easy.  I make WAN access to OpenVPN come in using UDP through a secure  
email port such as 143 or 993, as these few are generally not blocked by  
public networks e.g. at airports.  I forward this port to the usual  
OpenVNP port (1194) on the VPN server on the LAN.  Laptops try to connect  
to the server first over the LAN at port 1194, and if that fails, fall  
back to the WAN address+port.  I use client/server PKI certificates, with  
a pre-shared key during the handshake.  Passwords on the client  
certificates are possible, but I haven't used them.  For laptops, I think  
an encrypted root partition with a boot-up passphrase may be the way to go.

> I'm thinking that OpenVPN makes external SSH obsolete.  I could turn it  
> off forcing me to start a whole VPN in order to get access to the  
> internal interface.  Has everybody else already gotten to this  
> conclusion or are there lots of people still allowing remote SSH access?

The only time I ever enable external SSH access is temporarily to allow  
guest access from an external machine that is not (yet) included in the  
VPN, and even then I use an obscure port and forwarded that to port 22 on  
the target machine.  The only port normally left open on the WAN is the  
one for the VPN connection.  Heck, I can even reliably restart OpenVPN  
remotely via ssh over OpenVPN, with no open sockets lost and the  
connection barely misses a heartbeat.

Thanks,
Geoff
_______________________________________________
NMLUG mailing list
[email protected]
http://lists.b9.com/cgi-bin/mailman/listinfo/nmlug