Page 1 of 1

Configuration to allow remote SSH access

Posted: Thu Jul 08, 2021 3:12 pm
by paulandmildred
I'm a Fusion IP Broadband customer and would like to access my home workstation via SSH while traveling. As I do not have a static IP, I'm unclear how to connect via SSH while remote. My workstation is configured to allow incoming SSH (port 22) and I know the IP address (even if not static), but cannot connect when not on the network.

How might I go about setting this up?
Thanks.

Re: Configuration to allow remote SSH access

Posted: Fri Jul 16, 2021 10:10 pm
by belmontave
There are a number of "Dynamic DNS" services out there, which will host an DNS entry for you. You would then run a script regularly on a PC or RPI or even your router to update the DNS entry to match your current IP. You would then SSH to that DNS entry. For example, Google Domains supports it

Re: Configuration to allow remote SSH access

Posted: Sat Jul 17, 2021 3:30 pm
by igorru
It also sounds like you need to set up port forwarding on your router to allow incoming connections from the internet on port 22 to route to your workstation's port 22 on your LAN address.

Re: Configuration to allow remote SSH access

Posted: Mon Jul 19, 2021 7:52 am
by hbbrenum
Yeah, you'll need to enable port-forwarding on your router, and it probably wouldn't hurt to give your workstation a static IP address while you're at it.

Also, from a security standpoint, I'd recommend a) not leaving an open 22/tcp exposed to the internet, and b) not allowing password authentication for ssh to your workstation. For the first one, in the past, I've used a memorable-to-me non-registered port number to expose to the internet and put the custom port number in my

Code: Select all

~/.ssh/config
with an alias for my remote workstation. For the second, I only allow public-key authentication for machines that could in any way be exposed to the general public.

Re: Configuration to allow remote SSH access

Posted: Thu Jul 22, 2021 11:15 am
by nhbriggs
Consider Wireguard, with port forwarding on your router to a port on your home workstation. Then you can bring up a Wireguard VPN from your remote machine to your home workstation and ssh in over that VPN. It's an additional layer of security over having sshd on the workstation exposed to the Internet. Wireguard is available for most systems these days. It's fast, efficient, uses UDP rather than TCP for the underlying transport, and can support mobility of both ends of the VPN.

Re: Configuration to allow remote SSH access

Posted: Fri Jul 23, 2021 1:58 pm
by ds_sonic_asif
In regards to the dynamic IP address aspect of your problem, you don't necessarily need a dynamic DNS service.
Here is an alternative.

Re: Configuration to allow remote SSH access

Posted: Thu Aug 19, 2021 3:04 pm
by klui
While Sonic's mini hosting service is free, getting a domain is not. Services like freedns.afraid.org are free. They even provide the necessary scripts, in multiple varieties, to update. The only downside is the name is a subdomain.