SSH open on WAN after fresh install?

[JoeTheDownloader]

Hi,

First of all thanks very much Eric and anyone else involved in making Asuswrt-Merlin.

Just a quick note about a possible little security issue - I just did a fresh install over my existing stock Asuswrt. I had SSH enabled but it was only enabled on LAN (I know for certain that it was not responding on WAN before I installed Merlin). However after install, when I went through the settings to familiarise myself, I found that SSH was enabled on WAN as well! Obviously it is cool to have that feature as an option but I don't think it is a good idea for it to be on by default.

Is this expected behaviour, or a bug?

Thanks!

 

[RMerlin]

It's not enabled by default. Either you enabled it, or you disabled the firewall and are running an older version where dropbear binds to all network interfaces by default.

Also make sure you test from outside your network. Testing it from inside won't work, since you will be going through the internal loopback, never really leaving your LAN.

 

[JoeTheDownloader]

I did enable it - I had SSH enabled on stock before I installed Merlin. However it was only accessible on LAN - I'm certain of that as I remember nmapping from a server in AWS after I enabled OpenVPN to ensure that no ports were open. I'm also the only person with admin on this router.

Straight after installing Merlin I went through all the settings (to see what was newly available) and SSH was set to LAN+WAN before I adjusted anything. I then tested it, again from AWS, and was able to log in with my SSH key.

I have disabled it now so it is not a problem for me.

 

[RMerlin]

I did enable it - I had SSH enabled on stock before I installed Merlin. However it was only accessible on LAN - I'm certain of that as I remember nmapping from a server in AWS after I enabled OpenVPN to ensure that no ports were open. I'm also the only person with admin on this router.

Straight after installing Merlin I went through all the settings (to see what was newly available) and SSH was set to LAN+WAN before I adjusted anything. I then tested it, again from AWS, and was able to log in with my SSH key.

I have disabled it now so it is not a problem for me.

Asus changed the way this setting worked a couple of revisions ago. It's possible you got affected by this after an upgrade.

 

[JoeTheDownloader]

Cool okay. Well, regardless thanks for your work!