3 ms·

1. Sure, there may be cases where you already know the source IP or network block. But there are many scenarios where your legitimate users may be traveling, or

1. Sure, there may be cases where you already know the source IP or network block. But there are many scenarios where your legitimate users may be traveling, or using a mobile provider that won't guarantee much about the source IP. If you open your firewall too wide, a sophisticated attacker can find some box they can proxy through. 2. Doesn't wireguard then have the same challenge as SSH? Isn't that just pushing the problem around? Another way to cut down on the log spam is by configuring sshd to listen on a nonstandard port.

enasterosophes 2y ago
You must have missed the part where I said "Any attempt at illegitimate access needs to crack both wireguard and ssh." It doesn't push the problem to wireguard. It requires wireguard to be broken as a pre-requisite for trying their hand at your sshd, and then they also need to break your sshd.
aflukasz 2y ago
> Doesn't wireguard then have the same challenge as SSH? Isn't that just pushing the problem around? Yeah, it's actually weird how frequently in those discussions people say some version of "just use vpn". I guess they really mean "just make someone else responsible".