4 ms·
Indeed. The author could have spent 15 minutes setting up Tailscale [0] and not expose any listening administration ports to the Internet at all. If they wanted
by vngzs 5y ago
Indeed. The author could have spent 15 minutes setting up Tailscale [0] and not expose any listening administration ports to the Internet at all. If they wanted to avoid using a hosted service, Wireguard alone is incredibly defensive against attackers who do not have access to the secret material. Tailscale basically just adds some NAT traversal [1] and OIDC login wrappers.
[0]: https://tailscale.com/ https://tailscale.com/
[1]: https://tailscale.com/blog/how-nat-traversal-works/ https://tailscale.com/blog/how-nat-traversal-works/
- chockchocschoir 5y agoBefore complicating the setup even more (by adding more software), I'd opt to make sure I configure the software I already have before going down that route. Removing password login + changing the port would already remove any attack surface and make most scans not finding it at all. And if I'd still be annoyed by the amount of log items at that point, I'd add MAC/IP filtering at the firewall level before getting to the point of adding something like Tailscale. Unless I had multiple users who'd need to login of course, but then Tailscale suddenly become a paid product, and I'd probably add another instance as a bastion host at that point. I guess my point is: Make sure the software you already have is configured the right way before adding more software on top.
- Topolomancer 5y ago> I guess my point is: Make sure the software you already have is configured the right way before adding more software on top. Couldn't agree more!
- ratorx 5y agoI’d say MAC/IP filtering is more annoying in the long term than Wireguard, since I’m not sure I could say that I will 100% never need to access the server unexpectedly from somewhere else. But the ordering before that seem very reasonable. Although Wireguard is a soft alternative to changing default port, so it might be worth doing that. On a slight tangent, I’ve never really bought into changing SSH port from default. I’d say the convenience of not having config/extra port specification is worth having it on a well known port, but that’s just my personal philosophy. I feel like for my low traffic things, just having strong SSH key and auto-updates is good enough.
- jweir 5y agoChanging the port cut the invalid auths from 1000s a day to 0. Why deal with and log that spam?
- ratorx 5y agoDepends, I don’t think the storage requirements for the spam is that high and I would rather just use grep than remember the nonstandard port I picked. But I guess this is partly because I tend to look at logs a lot less than I SSH into my server.
- tptacek 5y agoWhat exactly are you trying to accomplish with MAC filtering?
- lormayna 5y agoNo need for any kind of MAC filtering: MAC is not propagated outside the L2 broadcast domain, so your server will see only the MAC of the default gateway (the router).
- Topolomancer 5y agoNot sure I understand the point of Tailscale. The server should expose these ports to the internet...that's part of its purpose. Admittedly, I have never heard about Tailscale until now; it appears to solve a different kind of problem than the one I am interested in.
- kortilla 5y agoYou don’t add tailscale if you care about open source.
- 0xdeadb00f 5y agoYou can run your own self-hosted Tailscale control server with Headscale.