1

I am currently trying to get to grips with server administration. Right now I am setting up security measures on an ssh + LAMP server running at home in my local network. I am following the suggestions in this thread for that: How to harden an SSH server?

What I am still confused about however is, whether breaching the server automatically breaches the entire network. Does an intruder get easy access to all other machines on the network once he has breached the server?

Community
  • 1
lo tolmencre
  • 145
  • The correct answer is "It Depends", and the reason it depends can be any of fifty thousand reasons. I assume on your home network you have only the one IP range and a standard consumer-grade off-the-shelf router or one provided by your ISP? – Thomas Ward Sep 14 '16 at 23:19
  • yes, that is right. – lo tolmencre Sep 15 '16 at 00:17

1 Answers1

2

This answer assumes that you are working with a typical residential home network, with an off-the-shelf router or an ISP-provided one with a single IP subnet on your network.

If you are stuck with one router, and only the one IP range, then unless every system on your network has a firewall and/or has been hardened, if your server is breached it will have access to your network.

Most routers and systems in a consumer-grade home network are not built with "security" in mind with the design, and do not have any types of isolation mechanisms that would isolate computers and machines from each other.

This does not mean you need to completely be worried, as there are many things you can do to protect the other systems on the internal network, such as (not all inclusive):

  • Install / configure firewalls on each system on the network.
  • Install antivirus on the network
  • Regularly check systems for 'oddities' and weird access problems that may arise, or signs of a breach, and pull it off the network as soon as that happens.
  • Don't install things you don't trust explicitly

... and other common-sense hardening tactics.

Note other concerns, like those pointed out by bgse in comments:

Also consider the potential of the attacker using the compromised machine to listen to network traffic, especially unencrypted traffic. In your typical home or small business network, this can quickly escalate to disaster.

Another problem is that the machine might still be considered thrustworthy by users on the network where this is no longer the case, e.g. a file server where the attacker might actually replace existing files with malware (like a small business keeping installer packages for their software in a single place to conveniently download on their private network).

Community
  • 1
Thomas Ward
  • 74,764
  • Also consider the potential of the attacker using the compromised machine to listen to network traffic, especially unencrypted traffic. In your typical home or small business network, this can quickly escalate to disaster. Another problem is that the machine might still be considered thrustworthy by users on the network where this is no longer the case, e.g. a file server where the attacker might actually replace existing files with malware (like a small business keeping installer packages for their software in a single place to conveniently download on their private network). – bgse Sep 14 '16 at 23:40
  • @bgse Not sure how many of your run of the mill home networks have fileshare servers, but you're right! – Thomas Ward Sep 14 '16 at 23:46