3 ms·
If you don't allow password logins so ssh only accepts public/private keypair authentication I think you have a secure setup. Limiting the IPs allowed to connec
by gregjor 5y ago
If you don't allow password logins so ssh only accepts public/private keypair authentication I think you have a secure setup. Limiting the IPs allowed to connect in the firewall will block the bots that probe port 22 and brute-force attacks, but those aren't going to succeed anyway. As far as I know it's not possible to brute force or otherwise hack ssh with ssl keypair authentication directly. An attacker would need access to your ssl private key. The ssh protocol resists MITM attacks as well.
If anyone knows about actual working attacks on ssh servers that don't allow password authentication I'd like to know about it. I don't mean state-level attackers who would probably hack into your laptop or strong-arm the hosting provider.
- dx034 5y agoTheoretically, a vulnerability in SSH could expose you, but I think those are quite rare. The bigger risk of keeping the server exposed is probably that some application opens another port. But that won't happen on Port 22, so that one could stay open to all.
- gregjor 5y agoI think ssh has been scrutinized by hackers already. Vulnerabilities I know about have to do with servers using deprecated encryption algorithms. Firewall rules in front of ssh are a good idea but I don’t think that adds security to ssh itself. It does block apps opening ports, as you point out.
- aborsy 5y agoOpenSSH is next to Wireguard in security, and, in my view, not too far behind (roughly similar to OpenVPN). I don’t think state level actors can compromise it, if properly configured. It’s far easier to hack the end point and steal the keys.