2 ms·

> SSH vulnerabilities OpenSSH is probably one of the most audited pieces of software running on your system. > SSH server misconfiguration Just like with TLS

> SSH vulnerabilities OpenSSH is probably one of the most audited pieces of software running on your system. > SSH server misconfiguration Just like with TLS use tools to validate your config (like https://www.ssh-audit.com/ https://www.ssh-audit.com/) and you'll be mostly safe. > Denial of Service Usually it's easier to DoS whatever other service your server is running, like a web backend och mail server or similar. --- On the other hand you now need to manage two keys, the wireguard one and the SSH one, and you still need to expose your wireguard server (which is not necessarily more secure than OpenSSH). Just disable SSH password auth, run one of the ssh audit tools like the one I linked above and use hardware keys like the openssh yubikey feature (optional but nice to know that the key can't be cloned). If you really don't want people trying to ssh to you move it to another port or use port-knocking.

paranoidrobot 2y ago
On the SSH points you make before the break - I don't particularly disagree on any part. But you still have to maintain it, and vulnerabilities do still get found. --- As for exposing Wireguard, that's not necessarily true - You can have your server dial-out to another host instead. Additionally, because Wireguard operates on UDP, and doesn't respond unless you pass the right credentials - it's very hard to detect from a cursory scan. You would have to already know what IP and port that Wireguard was listening on. SSH because it's TCP based can be detected by any random scanner, regardless of it's port. Unless you're using some conditional firewalling, such as like with port-knocking.