Hacker News Reader

Could you comment on my way of accessing my servers on AWS: My server are on VPC and no public ssh is allowed (nothing is open besides 443). When I want to login to my server , I run a script to modify security. (I have disabled ssh password logins and ssh is running on non standard port). And when I am done with task, I plug the hole in security group with another batch code. I am worried that I may be not exposing my servers with my practices.

View on HN

No op, but your practice is probably fine. More ideally, SSH would be locked down to your public IP address only. If you're already scripting this, you could just do a curl request to one of the many "what is my ip" services and set that instead of 0.0.0.0/0 as the security group IP address.

We also use bastion hosts. They're whitelisted for key-based SSH only access for our public IP addresses. We can jump around to other servers once we login to that one, but our externally facing servers never advertise anything other their base service (:443 or whatever is running on them).

I also use them with my personal servers and just leave them shut off when I'm not actively using them. This keeps costs down, but more importantly it permanently blocks off SSH access unless I'm specifically in need of it.

Did you try port knocking https://wiki.archlinux.org/index.php/Port_knocking

Reply on news.ycombinator.com