3 ms·
Absolutely, but I prefer not to leave 22/tcp open to the world. If I do leave it open it is only from a restricted IP set, otherwise it is behind a VPN, probab
by gerdesj 8y ago
Absolutely, but I prefer not to leave 22/tcp open to the world. If I do leave it open it is only from a restricted IP set, otherwise it is behind a VPN, probably OpenVPN.
- closeparen 8y agoIs OpenVPN a safer attack surface compared to OpenSSH?
- aaronmdjones 8y agoI doubt it.
- amdavidson 8y agoIs OpenSSH safer when used in addition to OpenVPN? Probably.
- romeisendcoming 8y agoSure, especially when you VPN into a sacrificial subnet and need MFA to continue elsewhere into locked down application domains. OTOH I would leave ssh listening on a non-descript high port with MFA (key and OTP) enabled. No use worrying too much about that.