3 ms·

If there isn't already, there needs to be something like the "Survivability Onion" from the Military[1], which has the first layer of the onion being: Don't Be

If there isn't already, there needs to be something like the "Survivability Onion" from the Military[1], which has the first layer of the onion being: Don't Be There. For hosting, one of those layers is going to be: Don't expose ports publicly, if you don't want people connecting to them. Unless you're hosting a public SSH service, you shouldn't expose SSH on a public network. It protects the VPS from a few avenues of attack: - SSH vulnerabilities (either current, or because the server has not been updated regularly) - SSH server misconfiguration - Credentials leaked/stolen - Denial of Service (hammering SSH in an effort to either consume resources on the host, and make it harder to fix/patch an issue, or to force your hosting provider to block SSH) [1] https://en.wikipedia.org/wiki/Survivability#Military https://en.wikipedia.org/wiki/Survivability#Military (at the bottom of the section)

SahAssar 2y ago
> SSH vulnerabilities OpenSSH is probably one of the most audited pieces of software running on your system. > SSH server misconfiguration Just like with TLS use tools to validate your config (like https://www.ssh-audit.com/ https://www.ssh-audit.com/) and you'll be mostly safe. > Denial of Service Usually it's easier to DoS whatever other service your server is running, like a web backend och mail server or similar. --- On the other hand you now need to manage two keys, the wireguard one and the SSH one, and you still need to expose your wireguard server (which is not necessarily more secure than OpenSSH). Just disable SSH password auth, run one of the ssh audit tools like the one I linked above and use hardware keys like the openssh yubikey feature (optional but nice to know that the key can't be cloned). If you really don't want people trying to ssh to you move it to another port or use port-knocking.
- paranoidrobot 2y ago
  On the SSH points you make before the break - I don't particularly disagree on any part. But you still have to maintain it, and vulnerabilities do still get found. --- As for exposing Wireguard, that's not necessarily true - You can have your server dial-out to another host instead. Additionally, because Wireguard operates on UDP, and doesn't respond unless you pass the right credentials - it's very hard to detect from a cursory scan. You would have to already know what IP and port that Wireguard was listening on. SSH because it's TCP based can be detected by any random scanner, regardless of it's port. Unless you're using some conditional firewalling, such as like with port-knocking.
PhilipRoman 2y ago
Seems like you're just trading one attack surface for another. Your "port" is exposed to the internet either way, you just replaced the service which is listening to it. The question is which you trust more - sshd or VPN.
- paranoidrobot 2y ago
  As mentioned, no, not necessarily. Wireguard is much harder to detect through a network scan, as it only listens on UDP and you have to pass valid credentials first.

SahAssar 2y ago

> SSH vulnerabilities OpenSSH is probably one of the most audited pieces of software running on your system. > SSH server misconfiguration Just like with TLS use tools to validate your config (like https://www.ssh-audit.com/ https://www.ssh-audit.com/) and you'll be mostly safe. > Denial of Service Usually it's easier to DoS whatever other service your server is running, like a web backend och mail server or similar. --- On the other hand you now need to manage two keys, the wireguard one and the SSH one, and you still need to expose your wireguard server (which is not necessarily more secure than OpenSSH). Just disable SSH password auth, run one of the ssh audit tools like the one I linked above and use hardware keys like the openssh yubikey feature (optional but nice to know that the key can't be cloned). If you really don't want people trying to ssh to you move it to another port or use port-knocking.

paranoidrobot 2y ago
On the SSH points you make before the break - I don't particularly disagree on any part. But you still have to maintain it, and vulnerabilities do still get found. --- As for exposing Wireguard, that's not necessarily true - You can have your server dial-out to another host instead. Additionally, because Wireguard operates on UDP, and doesn't respond unless you pass the right credentials - it's very hard to detect from a cursory scan. You would have to already know what IP and port that Wireguard was listening on. SSH because it's TCP based can be detected by any random scanner, regardless of it's port. Unless you're using some conditional firewalling, such as like with port-knocking.

PhilipRoman 2y ago

Seems like you're just trading one attack surface for another. Your "port" is exposed to the internet either way, you just replaced the service which is listening to it. The question is which you trust more - sshd or VPN.

paranoidrobot 2y ago
As mentioned, no, not necessarily. Wireguard is much harder to detect through a network scan, as it only listens on UDP and you have to pass valid credentials first.