3 ms·

You can do both, and in general most management teams should be at the very least using ssh configs if not full inventory management ala ansible/et al. Whiteli

You can do both, and in general most management teams should be at the very least using ssh configs if not full inventory management ala ansible/et al. Whitelisting IPs may work with your corporate vpn, it most certainly does not work for hobbyists on consumer ISPs. Moving the port deflects a lot of low effort attacks, and if the ssh server is otherwise still well secured then provides no harm and real benefit.

mrweasel 6y ago
Depending on what your tasks are, distributing ssh configs to 100+ people isn't that feasible, but yes, ssh configs help, but you're back to ensuring that the information is correctly distributed. Chances are that the servers and users are managed somehow, while laptops and workstation may or may not be. You could use a jump host, but then why not just whitelist the IP for the jump host? Just disabling password logins is just as good or better than moving the port. Don't want your logs to explode: logrotate! If it's just for a hobbyist on a consumer ISP then sure move your port, implement port knocking, use VNC, I don't care. For business, moving the SSH port is a weird thing to do, it's not that effective and you should already have other security measures in place that makes moving a port pointless.