2 ms·
> That said, blocking all countries that you don't expect to talk to All fun and games until you find yourself on travelling in Asia and you need to connect ba
by traceroute66 5y ago
> That said, blocking all countries that you don't expect to talk to
All fun and games until you find yourself on travelling in Asia and you need to connect back home and forgot you blocked half the world.
As for "other processes", we're talking about SSH on this thread. If you've got other processes then that falls into on-host/upstream filtering via firewall area of security. Regarding "unknown vectors", as I said, patching, no amount of IP blocking will help you with that.
If you really want to talk about "world's second easiest security fix" for SSH, that would be running a super-hardened bastion host and using SSH ProxyJump.
- kijin 5y ago> All fun and games until you find yourself on travelling in Asia Leave a cheap droplet running somewhere, whitelist its IP, and SSH through it. I'm in Asia and I do exactly that with my U.S.-based servers. Actually, I've blocked all of the rest of the world as well, except the proxy droplet. It's like a global bastion host. There's no legitimate reason for anyone else on this planet to try and SSH into those boxes.