Topic: sshd, AllowHosts and dyndns

[csn]

Hi all,

I've got two SME Servers at different locations and am using rsync with ssh certificates to mirror data between them as part of an overnight cron job.

The slight complication is that the 'guest' server internet connection doesn't have a static IP, so I'm using dyndns.org to give it a domain.

Not wanting to open my 'host' server up to the world, despite the certificates, I've set the AllowHosts db item for sshd to the server's local network as well as the dyndns address of the guest server, i.e. me.dyndns.org. I'd seen this in various FAQs and the first time I tried it, it worked fine.

However, after a few days the host stops talking to the guest. I'm assuming that this is due to the IP address being updated. What I can't understand is why this causes a problem - if I ping me.dyndns.org from the host server then I get back the correct, updated IP. I've checked on my router, the dyndns site and everything is updating quickly enough to be in sync.

Going on to the host server, not changing anything and running a 'signal-event remoteaccess-update' magically fixes the problem.

I'm therefore wondering if the IP address for the dyndns entry is cached somewhere from the moment you run the update, or is translated into an IP address for the firewall.

Any thoughts on this and how to keep it working for more than a few days would be much appreciated!

Thanks,
Chris.

[mmccarn]

I've run 5 or more SME servers for the last 10 years or so.  I've found that simply changing the port used by sshd eliminates the traditional dictionary attacks on ssh (config setprop sshd TCPPort 2200)

Other than that, you could "allow" the entire dynamic ip range (or ranges) used by the system on dyndns (and change the default port for sshd).

Finally, you could attempt to reverse the direction of the connection - have the system with the dynamic ip connect to the system with the fixed ip, then start the transfer.