3 ms·
Start by just using ssh keys and disabling password auth. If you wanna go further, use something like Tailscale/WireGuard to move you SSH daemon off the public
by akerl_ 4y ago
Start by just using ssh keys and disabling password auth.
If you wanna go further, use something like Tailscale/WireGuard to move you SSH daemon off the public internet. Or use something like Teleport or Vault to issue short-lived per host keys backed by your centralized auth source. Or do both of the above.
- stevenjgarner 4y agoI understand how they all provide (good) value for MANAGING ssh keys, but respectfully, I don't understand how/that they harden ssh at all? Why does SSH need hardening? I get that if a user is mis-managing keys that is a problem, but it is not necessarily an ssh problem.
- akerl_ 4y agoHardening SSH doesn’t generally mean “making the openssh process more secure”. It means “making connecting to your servers more secure”. So turning off password auth, or restricting network access to the SSH daemon, or using stronger centralized auth all do that. Most of the risks that affect SSH are around credential lifecycles, weak credentials, and credential compromise.