Ubuntu server - remote admin

[A[L]C]

Hi all,

I've just installed ubuntu server on my microserver and was wondering if there is any remote console software that I can use? Sort of like teamviewer is for windows

Thanks

 

[memyselfandi]

As it's the server variant .... SSH

 

[A[L]C]

Is it actually a good idea to open port 22 to the internet though? Sounds risky

 

[memyselfandi]

Well I wouldn't ... but there are various things you can do to help mitigate like not running it on port 22 (or running on port 22 but doing things with port forwarding on your router so it doesn't appear externally on that port), using key based authentication rather than passwords or depending on what else you have then VPN in and then SSH through like normal ...

 

[lamboman]

Technically you can do this however you want, but if you want to do it right: https://tools.ietf.org/html/rfc6335#section-6

Select a port from the Dynamic/Private/Ephermeral range. Set a port forward up from an external port between 49152 and 65535 to 22 of Ubuntu machine.

 

[joeyjojo]

SSH exposed is a little risky, but you can do a lot to reduce the risk. Ubuntu has a nice little page on this https://help.ubuntu.com/community/SSH/OpenSSH/Configuring

Most important things (IMO) are 1. double check that it's not possible to log in as root (see PermitRootLogin), and 2. disable password authentication in favour of key-based.

If you are the only person using the server you can make yourself a 2048 bit key (or more) and practically guarantee that it's impossible for anyone else to get in. The only remaining risk being exploits in SSH etc., but they're out of your control.

If you want the desktop environment you can easily tunnel VNC over SSH.

 

[bigredshark]

Technically you can do this however you want, but if you want to do it right: https://tools.ietf.org/html/rfc6335#section-6

Select a port from the Dynamic/Private/Ephermeral range. Set a port forward up from an external port between 49152 and 65535 to 22 of Ubuntu machine.

This is always a matter of contention - if you're extremely paranoid then setting custom ports might be worthwhile, but disabling root login and password auth are *far* more valuable things to do from a security standpoint.

I've had a few port 22 SSH instances open to the world for years and given those precautions had no issues.

For me, remembering the damn port and typing -p 12345 on the end of every ssh or scp command is far more bother than it's worth.

Or, run an OpenVPN instance and expose that on port 443 - which is useful for getting through the more restrictive firewalls in some places and nobody seems to bother trying much against exposed tcp/443 for various reasons...

 

[On Holiday]

1 - Custom SSH Port
2 - Disable root login and use another somewhat random username (not necessarily characters, just not something like "admin").
3 - Firewall including bruteforce protection i.e: ConfigServer Security & Firewall

Done.

 

[Tom B]

If you're opening up SSH it's a good idea to enable two-factor authentication: http://www.howtogeek.com/121650/how...gle-authenticators-two-factor-authentication/

This means you need a password and a key generated by your phone to log in remotely.

 

[bigredshark]

Or knockd is a clever option - I'd rate it above random ports as it is IP specific...

Still too much hassle in my opinion and key based auth on port 22 is perfectly sufficient, but it's an option...

 

[Stelly]

Or knockd is a clever option - I'd rate it above random ports as it is IP specific...

Still too much hassle in my opinion and key based auth on port 22 is perfectly sufficient, but it's an option...

dont use certs mate?

Stelly

 

[joeyjojo]

For me, remembering the damn port and typing -p 12345 on the end of every ssh or scp command is far more bother than it's worth.

This basically.

I subscribe to the "security through obscurity is no security at all" camp. Just keep it on port 22 with only key-based authentication and the chances of intrusion are practically zero.

 

[Bagnaj97]

Install fail2ban. https://help.ubuntu.com/community/Fail2ban
It's fairly simple to set up and will help prevent brute force attacks.

 

[ChrisD.]

run an OpenVPN instance

This.

 

[GeX]

1 - Custom SSH Port
2 - Disable root login and use another somewhat random username (not necessarily characters, just not something like "admin").
3 - Firewall including bruteforce protection i.e: ConfigServer Security & Firewall

Done.

1. meh
2. create no root account, no password login at all. using keys
3. meh, fail2ban