Recently my EC2 server was hacked and it was totally my fault. I enabled password authentication and I set the password way too simple. I took a look at the log and I found out there are indeed many free people who keep trying to log in using brute force method.
To secure my server, I decided to limit SSH access to my office and home IP addresses only. Here are the steps.
- Go to “AWS Management Console” and select “Security Groups”
- Select the security group which is used for the instance, e.g. “quicklaunch-0″
- Delete the existing SSH access which is set to allow any IP addresses, “0.0.0.0/0″
- Find out what is your current IP address by searching “what is my ip” in Google (Sorry Bing, you don’t understand this yet. Maybe one day when you grow up).
- Select SSH from the “Create a new rule” drop down list
- Customise the “Source” field with your own IP, e.g. “212.157.7.65″ and add “/32″ at the end, which is “212.157.7.65/32″
- Click “Add rule” and “Apply rule changes”. Now your server only allows this specific IP address to login
- You can add multiple SSH rules with different IP addresses
- If you want to allow a range of IP addresses, you need play around with the “/32″ part
- An IP address has 4 parts, separated by 3 dots. Each part is 8 bit (2 to the power of 8 ) and that makes 255.
- “/32″ means the IP address allowed to access the server must match all 4 parts (8×4)
- “/24″ means the IP address allowed to access the server must match the first 3 parts, which means “212.157.7.XXX” is allowed
- It’s not hard to figure out “/16″ and “/8″ require less matching
- I’m not sure how to match a specific range e.g. “212.157.7.60 - 212.157.7.200″. Maybe “/29″ will work, but I’m not sure.
I hope this helps.
Read More