3 ms·
would you rather emergency security patch opensshd on 10 machines or one bastion host?
by pilif 8y ago
would you rather emergency security patch opensshd on 10 machines or one bastion host?
- supertrope 8y agoIf you're worried about zero days you might consider not allowing SSH through firewall and requiring connecting to VPN first. That'd require a flaw in both OpenVPN and SSH.
- jacob019 8y agoNot worth the added complexity. Exposing sshd (w/ disabled passwords) is common practice and fine for most use cases. Special use cases may require special precautions, but even airgapped systems can be compromised with enough effort. I'll take my chances with the industry standard and update as needed.