3 ms·
A genuine question on this topic, does that mean we should have SSH ports open to the world too? If we have some form of 2FA? Or I’m misreading the point of bey
by gizmodo59 6y ago
A genuine question on this topic, does that mean we should have SSH ports open to the world too? If we have some form of 2FA? Or I’m misreading the point of beyond Corp.
- wmf 6y agoSSH through a Teleport/Boundary-style bastion can be viewed as BeyondCorp for developers.
- ndomer 6y ago(Author here) I think the second most secure way to handle service authentication is to protect your ports with strong auth, like this article talks about. But the most secure way to handle this is to just eliminate the open port entirely. Here's another post of mine where I talk about making a bastion host with no open ports and no ingress on its security group: https://codelabs.transcend.io/codelabs/aws-ssh-ssm-rds/index.html?index=..%2F..index#0 https://codelabs.transcend.io/codelabs/aws-ssh-ssm-rds/index...