Hacker News Reader

Comment by reacweb | Hacker News Reader

For my home computer, sshd is always on. It is configured to disable password authentification. On the firewall, I authorize only two things: ssh port and wakeonlan. If I need to access another port, it is generally enough to open temporarily a ssh tunnel.

I think that you lose most of the advantages of a unix computer if you can not access it remotely.

View on HN

I have Linux on all my home machines, and none are configured to be accessed remotely. There are still plenty of advantages. Far less viruses / malware / crapware. Better performance on under powered machines. Better development environment (for the sort of development I do). No phoning home to MS / Apple (as far as I am aware).

> I have Linux on all my home machines, and none are configured to be accessed remotely. There are still plenty of advantages. Far less viruses / malware / crapware.

I don't think the 2 ideas are related. I can't think of a script kiddie that would brute force your SSH to install a virus on it. Join a botnet maybe - but probably not to just install a virus.

Also if you use something like SSH keys or OTP - it's pretty much guaranteed that no one but you can access it.

I think I would need to configure my router to port forward ssh before they could do that.(Or am I being dumb assuming that they can't get around that?)

Anyway my point was that Linux has plenty of advantage (for me) without being remotey accessed.

Today, my wife (at home) has called me (at work) because she could not launch chrome anymore. The disk was full. The files /var/log/kern.log and syslog were eating gigabytes. I was able to solve her problem remotely. I have also installed ubuntu on the computer of my old father who lives far. Regularly, I upload pictures (he is my backup for pictuers) and put a shortcut on his desktop.

I suppose SSH is easier to use on machines you don't own, but the best practice would be to set up a VPN tunnel. 6 - 1/2 dozen.

Why is a VPN better practice?

Only I've been using sshuttle to make ad-hoc tunnels and it's exceedingly easy - there's details at http://alicious.com/digitalocean-free-credit/ (if you'll forgive the rather mercenary promotional slant in that post).

In short "$ sshuttle --dns -r root@X.X.X.X 0/0 --exclude 192.168.0.0/9 # start sshuttle" tunnels everything but my local network over a server with SSH on it [I've not checked for myself with Wireshark yet, do your due diligence].

When setting up I found [Open]VPN a bit protracted in comparison.

VPN and SSH are only partially overlapping in their features. Are you suggesting that SSH only allows local connections, and your VPN is what allows you local network access?

Reply on news.ycombinator.com