I would like to open up port 22 so my tech staff and I can ssh, scp into the
servers. How safe is it for me to open up port 22 on my firewall. I noticed
when I opened up the ftp port I got hits banging away at it for entrance. I
closed it right away.
You should expect "knocking" on any door that's visible to the public.
Fortunately ssh is more secure (generally speaking) than ftp.
However this doesn't eliminate potential DoS attacks you may receive
from having the doorbell rung. These can have a negative impact if
you use passwords and not keys. (Keys also give you the advantage of
being able to log in when passwords won't work.)
If you were truly concerned you'd use a VPN at your network border, a
bastion host, or other secure practices. Talk to your systems,
networks, or security managers.
At 3:36 PM -0400 3/13/07, Adam Gerson wrote:
I know but I have a few non tech staff users that want access to our file
server who are competent enough to use an SFTP or SCP client with detailed
instructions, but to set up a VPN we have found it takes a few more steps
like editing their home routers to allow vpn passthrough and I think it goes
beyond a few of them. Look for a safe, but not totally complicated solution
to remote file access.
So you'd rather take the easy, cheap and lazy way out? Nice.
If the goal is to provide access to your fileserver then a VPN would
seem the right choice here since they could then, well they could
then just access the file server like they normally do rather than
mess with ssh, et cetera.
Using VPNs need not be complicated or complex and if it's something
my mother can do so can your users. PPTP is pretty robust through
firewalls. But hey, be lazy and make them use strange tools and learn
new things that they can break.
If you do decide to be lazy and silly and use ssh, you might at least
build them and ssh tunnel so that they can still use their file
services in the normal manner.
--
-dhan
------------------------------------------------------------------------
Dan Shoop AIM: iWiring
Systems & Networks Architect http://www.ustsvs.com/
email@hidden http://www.iwiring.net/
1-714-363-1174
"The wise man doesn't give the right answers, he poses the right
questions." -- Claude Levi-Strauss
iWiring provides systems and networks support for Mac OS X, unix, and
Open Source application technologies at affordable rates.
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Macos-x-server mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
http://lists.apple.com/mailman/options/macos-x-server/email@hidden
