[Help] Remote PC Connection

JerikTelorian

There is a thread on this, though about 4 months old, so I started a new one rather than raise the dead.

I used to have a TightVNC-over-FreeSSHd tunnel running on my desktop. Then one day I noted many unauthorized login attempts over the course of about 20 minutes, shut down the servers, uninstalled everything, and haven't tried again.

I'm interested in getting this set up once more, but want some advice on the property security measure to take to avoid problems.

1.) Should I use TightVNC, or something else? I did like the option of using a web browser, but that didn't seem to work over FreeSSHd, so I couldn't use it anyway.

2.) Same for FreeSSHd -- should I continue using this server or is another one out there better?

3.) What firewall/security steps should I take to lock the server machine down? I was using an RSA key, which (supposedly) adds a decent level of security to things; should I keep going with RSA or is there something better?

I'm not very knowledgeable about these security issues, so help is appreciated. The machine is connected via physical line to a wireless router which has WPA/WPA2 encryption (unfortunately, one of the PC's in the house won't connect to WPA2, so I need to have both, despite WPA now being cracked). The router is running standard company firmware.

I had been using DynDNS to connect easily to the machine, is this okay?

Thanks in advance.

PeregrineFalcon

Dude, as long as they were just attempts, you likely just had some script kiddie going "ololopenport" and trying repeatedly to log in. Not sure if FreeSSH vs OpenSSH has the option, but you should be able to make it ignore all attempts from a certain IP for a duration after a number of failed logins.

Barrakketh

I would also disable password logins for SSH and stick to using your keypair.

Fun tidbit: I just checked my auth logs and found 3054 invalid user logins, 2851 of which were from the same IP. I think I should probably hammer out a script to ban excessive login attempts.

exoplasm

Try out NoMachine NX Free Edition or FreeNX as an alternative to VNC. It works much like Windows Terminal Services (read: very good) and is encrypted over SSH. Also setup fail2ban to prevent people from attempting brute force attacks. You can also use an alternate port from 22 for ssh.

Edit: Above was assuming a Linux server (or BSD I suppose).

If you are using Windows you might as well just Remote Desktop / Terminal Services (port 3389) which is also encrypted. I also like to use Hamachi for VPN access on Linux and Windows. Easy to setup and work with rather than opening public ports.