3 ms·
Just to reduce the crap in the log and also because I can, I have my SSH servers (not saying what their IPs are) using a very effective measure: traffic is drop
by TacticalCoder 3y ago
Just to reduce the crap in the log and also because I can, I have my SSH servers (not saying what their IPs are) using a very effective measure: traffic is dropped from the entire world, except for the CIDR blocks, which I put in ipsets, of the five ISPs over three countries I could reasonably be in when I need to access the SSH servers.
And if I'm really, say, in China or Russia an really need to access one of my servers through SSH, I can use a jump host in one of the three countries that I allow.
So effectively: DROPping traffic from 98% of the planet.
Boom.
- bradknowles 3y agoDeny by default, allow only those sources that are considered trustworthy. And frequently re-evaluate who and what should be considered trustworthy.
- aborsy 3y agoOr close the ports, and install an agent that phones out such as Tailscale or twingate.
- Fnoord 3y agoOr just Wireguard itself.
- PLG88 3y agoThis is the way, outbound only connections so you can stop all external unauthenticated attacks. I wrote a blog 2 years back comparing zero trust networking using Harry Potter analogies... what we are describing is making our resources 'invisible' to silly muggles - https://netfoundry.io/demystifying-the-magic-of-zero-trust-with-my-daughter-and-opensource/ https://netfoundry.io/demystifying-the-magic-of-zero-trust-w...
- Fnoord 3y agoI don't want to be able to auth whilst physically in authoritarian regimes. If I had to be physically there it'd be via burner devices.