4 ms·
Another good option is making SSH only accessible over Tailscale or a VPN.
by GordonS 2y ago
Another good option is making SSH only accessible over Tailscale or a VPN.
- nativeit 2y agoThis, with key pairs, is the best blend of security and convenience. I use ZeroTier and UFW on the server and it’s really very simple and extremely reliable. On the very rare occasion that ZeroTier encounters a problem, or my login fails, I still have IPMI access through Proxmox/VMWare and/or my server provider.
- Someone1234 2y agoThe two aren't exclusive of one another. We've also witnessed situations, with major companies, wherein an SSH "leaks" outside the VPN due to network misconfiguration or misconfiguring interfaces on the server. As I said above, keys are actually more convenient than passwords. Only reason people still use passwords is because they believe keys are difficult to use or manage.
- vaylian 2y agoHow do you protect the access to the VPN/Tailscale? I suppose you are not using a password?
- GordonS 2y agoSSO and MFA, with a Microsoft account.
- vaylian 2y agoThat's an easy solution. But there is a lot of hidden complexity and it also makes you reliant on third parties https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/ https://www.microsoft.com/en-us/security/blog/2024/01/25/mid...
- GordonS 2y agoIDD, but it depends on your threat model. Personally, it's a tradeoff I'm happy to make, but an alternative would be setting up your own VPN, e.g. Wireguard.