2

Disclaimer: I am not sure if this is a question for the Pi StackExchange site, but I am posting it here anyway. If it should be moved elsewhere, please do not hesitate to suggest where it should be moved to.

I only just setup my Pi last night. I have configured very little as of yet.

My home intranet, at the moment, has two computers connected to a Belkin router, which in turn is connected directly to the internet via a cable modem. - my RPi is wired directly via ethernet cable and my laptop via wireless (Windows 7 on laptop).

I can access my Pi console via SSH and Putty on my laptop.

How can I ensure that the Pi only allows connections into it from my laptop and my laptop alone? Perhaps this has something to do with the MAC address?

I ask this question because I can configure my Belkin router to only accept wireless connections from specific MAC addresses. (Therefore one more level of security - besides WPA encryption on wireless access point). So if someone wanted to access internet through my router, they not only need to crack the WPA password, but they also need to spoof my MAC address (presumably).

I would like to do something similar, specifically for the PI. If someone were to hack the router, it would be nice if the PI restricted access to itself from any computer other than one I have specified (my laptop).

If it is not already evident, I am quite a noob when it comes to network security (but eager to learn :) ).

EDIT

Not sure if this is relevant or not, but eventually I will have the Pi connected to the router via an Edimax USB adapter: http://www.edimax.com/en/produce_detail.php?pd_id=347&pl1_id=1.

In the near future, I also intend to buy one or two more Pi's and have them communicate with each other via the router in my home network.

  • 1
    This is not a Pi specific question but an ssh question. You might get more help on unix.stackexchange.com or stackoverflow.com. However, I can point you in one direction. Disable password authentication on your Pi and use only ssh key pairs. With a little search you'll find all the info you need. – foibs Dec 21 '13 at 18:56
2

I suggest you go with @foibs solution to disable password login and use ssh key pairs only. That will ensure only clients with the private key you generate can connect to the RPi. (if you keep the private key on your laptop, only you will be able to login)

Check out PuTTYgen - make sure you can sign in without the password, before removing the password login option in the sshd config file.

@Goldilocks solution might work for you too, but does not block a malicious attacker which copies your IP, as is also noted in the post.

5

If someone were to hack the router, it would be nice if the PI restricted access to itself from any computer other than one I have specified (my laptop).

You can't, since if someone hacks the router, they could (for example) kick one of your other computers off the network and replace it using the same internal IP and MAC address (MAC addresses are easily spoofed).

IP and MAC address are the only ways to identify who you are connected to below the application level, and neither of them is definitive or reliable for purposes of security. At the application level, you have various techniques such as those used with SSL, whereby key only access and certificates can provide secure forms of identification.

However, you can still restrict access based on MAC or IP address to protect against intruders that access the network but do not have any control of the router -- in which case they won't be able to supplant an IP. MAC address spoofing is still possible, though, so you are better off giving the computers you want access to the pi a reserved IP on the router, and then using that.1

The normative way to restrict access is via a firewall. The most common firewall interface on linux, which is installed by default on raspbian, is iptables. A complete introduction to that is beyond the scope of a Q&A, but there are various tutorials around, and the man pages explain most of the details. An example of an iptables rule is:

-A INPUT -s 192.168.0.4 -p tcp --dport 80 -m state --state NEW -j ACCEPT

Which restricts incoming HTTP (port 80) requests to a single IP if there is a default rule that incoming packets not ACCEPT-ed will be REJECT-ed. Rules are generally grouped in order into a file and then fed in via iptables < rules.txt -- once you have these worked out you can append that to /etc/rc.local to load them at boot.

Keep in mind that firewalls are your first line of defense, not the last nor the most important, and they are limited in what they can accomplish. This is discussed in the footnote ("the most important part of network security takes place at the application level").


1. Of course, IP reservations are done by MAC address, and even if the "real" computer is already on the network and has the IP, it is not a big step for an attacker to sniff and spoof packets, but this will be complicated by the activity of the real computer. This is why the most important part of network security takes place at the application level. If you are on a network, you can't hide your computer from another computer on that network, which is really what you are asking to do. What you can do is make sure the individual server applications that you run (such as sshd) are configured in a way that unauthorized parties cannot use them to do anything significant to the system.

  • Unless you are experienced and/or know exactly what you are doing, I would recommend against tinkering with firewall rules. It is so easy to do something not quite right causing something else to work incorrectly. – Thorbjørn Ravn Andersen Dec 23 '13 at 17:53
  • @ThorbjørnRavnAndersen : Since the initial default on raspbian is no rules, 1) You won't accidentally make anything less secure, 2) You'll likely understand the rules since you made all of them (of course if you don't, then you can end up blocking something you need, but you'll probably figure that out...). Configuring a firewall to only allow the traffic you want will also help you to identify what that traffic is and the applications that handle it, which is where your most serious security concerns are. – goldilocks Dec 24 '13 at 13:55
2

If you are not a hardcore Linux administrator the simplest way to do this is to buy an additional router to set inbetween the Pi and your current router, and configure that new router to whatever restrictions you want.

Personally I would consider putting the router between your network and the internet so your whole network are behind two NAT-firewalls and then just leave the Pi as it is.

  • Cool idea. I had not thought of this. Is there any reason I could not set the restrictions on the current router? Why would I buy a new one? Is this just to add one more level of security? – Josh Dec 23 '13 at 17:44
  • 1
    I was supposing that if you could, you already had. You probably can. But with a second router you can choose yourself instead of using what ever your ISP gave you, and then pick one supported by e.g. Openwrt which makes it easy to do all kinds if interesting things through a web interface. – Thorbjørn Ravn Andersen Dec 23 '13 at 17:51
0

If you're using a Win 7 on your laptop, you can use a Free-ware called WIN-SCP that will allow different connection protocols between two devices (basically your Pi and your laptop). I recommend it in your case because it can use "key files" (don't know the good name in English) so you must have the corresponding file on the computer asking for connection.

This gives you one more level of security because the hacker would have to : - be blocked by your pi - identify wich software you're using to ssh with the pi - find the "key file" in your computer - to finally connect to your PI.

In my opinion it's very handy. I'm using it everyday, it's a bit tricky the first use but you don't need anymore passwords from the computer that has the corresponding key file.

Hope I helped, TDT

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.