I HAVE A DREAM Public Facing (SIP) + TravelinMan (SSH, etc) ?

[markd89]

I read http://nerdvittles.com/?p=30297 about the Public Facing option where a FQDN is needed to connect to the server.

I like the idea of doing that to make access easy for Softphones on Android.

Part of @wardmundy's writeup is to obfuscate the SSH port. I'm assuming that this is because SSH is now open to the world.

My question is why not combine the FQDN idea with TravelinMan? i.e. Require FQDN to access the server for SIP, but for other protocols require a whitelisted/TravelinMan IP.

This would make it easy for users with cell phones (who may not be technical) and for admin access (me), I can jump through the TravelinMan hoops for SSH. The result should be a more secure server as only SIP is open to the world.

What do you think?

 

[KNERD]

Or you could setup VPN where SSH is only listening on port 22 of the VPN private IP address of the server.
Another easy option is to use certificate only login access to SSH

 

[wardmundy]

I read http://nerdvittles.com/?p=30297 about the Public Facing option where a FQDN is needed to connect to the server.

I like the idea of doing that to make access easy for Softphones on Android.

Part of @wardmundy's writeup is to obfuscate the SSH port. I'm assuming that this is because SSH is now open to the world.

My question is why not combine the FQDN idea with TravelinMan? i.e. Require FQDN to access the server for SIP, but for other protocols require a whitelisted/TravelinMan IP.

This would make it easy for users with cell phones (who may not be technical) and for admin access (me), I can jump through the TravelinMan hoops for SSH. The result should be a more secure server as only SIP is open to the world.

What do you think?

The problem with a WhiteList for SSH is, when you're out of town, you are locked out. Any of @KNERD suggestions eliminate this.

 

[markd89]

The problem with a WhiteList for SSH is, when you're out of town, you are locked out. Any of @KNERD suggestions eliminate this.

Thanks, Ward. Wouldn't TravelinMan always make sure I have access. (Always = within a few minutes of my dynamic dns updating)?

 

[wardmundy]

Thanks, Ward. Wouldn't TravelinMan always make sure I have access. (Always = within a few minutes of my dynamic dns updating)?

It should, yes.

 

[markd89]

If I enable Public Facing with your script, does TravelinMan coexist or is there hacking involved in using them together?

(I looked at your install script and it's a little over my head)

Thanks again,
Mark

 

[wardmundy]

It would take some reworking unfortunately.