Topic Thread

Expand all | Collapse all

Allow user to SSH from home to his PC

  • 1.  Allow user to SSH from home to his PC

    Posted 05-04-2018 05:33

    How can I allow a user to SSH to his UNIX box from home? Can I set it up so when his home address (and only HIS home address) SSH to my external address he will forward right to his machine?



  • 2.  RE: Allow user to SSH from home to his PC

    Posted 05-12-2018 02:20

    hi,

    I suggest to use an identity based policy in which you use the VIP. Just add a user group (with just one user) to the source field (formerly: source address field) in the policy.

    Only if your user has got a fixed public address you might use it to identify your user.

    Details:

     

    1- VIP: external addr: free public address, mapped to addr: private ssh_server_IP, external/mapped to port: tcp/22

    2- policy: either

    src addr: any AND usergroup: this_user

    OR

    src addr: fixed home office address

     

    dest addr: VIP, service: SSH



  • 3.  RE: Allow user to SSH from home to his PC

     
    Posted 05-13-2018 20:56

    I suggest using an identity-based policy in which you use the VIP with customized SSH port on the public network.
    This article will help you.

    http://cookbook.fortinet.com/port-forwarding/

     

    Regards,

    Deepak Kumar



  • 4.  RE: Allow user to SSH from home to his PC

     
    Posted 09-04-2018 05:37
    Hi,

    You can use VIP with customized SSH port. Since your publishing to the internet customizing ssh port is important to avoid attackers.

    Regards

    ------------------------------
    Rony Moussa
    Fortinet NSE Certified: Level 8
    ------------------------------



  • 5.  RE: Allow user to SSH from home to his PC

    Posted 09-13-2018 07:44
    I suggest using VPN SSL to be able to connect to a protected server, behind a FGT.
    Tunnel mode (with FCT) or web portal mode is possible.


  • 6.  RE: Allow user to SSH from home to his PC

     
    Posted 09-14-2018 06:49

    Generally it is very difficult to create a rule for someones home IP address as they change from time to time.  It can be done but be prepared for users to complain every time they get a new IP and the Policies no longer work. From a security perspective direct SSH access from "any" can open you up to a lot of potential issues, brute force attacks etc.  Not something I would recommend.  Changing the service to a non-standard port is also not recommended because the service can be fingerprinted and identified by tools like NMAP, and other port scanners.

    Using SSL VPN  for remote access to internal resources is the answer, in my opinion.



    ------------------------------
    Dan
    Network / Security Analyst

    ------------------------------



  • 7.  RE: Allow user to SSH from home to his PC

     
    Posted 09-17-2018 00:02

    If it's a public server, VIP + policy SSH with source ip (home).

    If it's a private server. Client IPsec or client SSL VPN w native - or FortiClient.

    In the policy SSH as service. Add IPS and AV in the policy since this is a home user = no ctrl over home environment.



    IPsec VPN with FortiClient - Fortinet Cookbook

    Fortinet Cookbook remove preview
    IPsec VPN with FortiClient - Fortinet Cookbook
    In this example, you will allow remote users to access the corporate network using an IPsec VPN that they connect to using FortiClient for Mac OS X, Windows, or Android. The remote users Internet traffic will also be routed through the FortiGate (split tunneling will not be enabled).
    View this on Fortinet Cookbook >


    SSL VPN using web and tunnel mode - Fortinet Cookbook

    Fortinet Cookbook remove preview
    SSL VPN using web and tunnel mode - Fortinet Cookbook
    In this example, you will allow remote users to access the corporate network using an SSL VPN, connecting either by web mode using a web browser or tunnel mode using FortiClient. Web mode allows users to access network resources, such as the Internal Segmentation Firewall (ISFW) used in this example.
    View this on Fortinet Cookbook >







    ------------------------------
    Odd [LastName] [Designation]
    IT Security Specialist / Senior IT Consultant
    [CompanyName]
    [City] [State]
    [Phone]
    ------------------------------