4 ms·
I’d say MAC/IP filtering is more annoying in the long term than Wireguard, since I’m not sure I could say that I will 100% never need to access the server unexp
by ratorx 5y ago
I’d say MAC/IP filtering is more annoying in the long term than Wireguard, since I’m not sure I could say that I will 100% never need to access the server unexpectedly from somewhere else.
But the ordering before that seem very reasonable. Although Wireguard is a soft alternative to changing default port, so it might be worth doing that.
On a slight tangent, I’ve never really bought into changing SSH port from default. I’d say the convenience of not having config/extra port specification is worth having it on a well known port, but that’s just my personal philosophy. I feel like for my low traffic things, just having strong SSH key and auto-updates is good enough.
- jweir 5y agoChanging the port cut the invalid auths from 1000s a day to 0. Why deal with and log that spam?
- ratorx 5y agoDepends, I don’t think the storage requirements for the spam is that high and I would rather just use grep than remember the nonstandard port I picked. But I guess this is partly because I tend to look at logs a lot less than I SSH into my server.