> Isn't that strictly better? I think that greatly depends on the VPN. For something like Wireguard with a tiny attack surface? Sure, you can make that argumen

> Isn't that strictly better? I think that greatly depends on the VPN. For something like Wireguard with a tiny attack surface? Sure, you can make that argument. For something big and sprawling like a commercial VPN (or even something open source like OpenVPN) - I think unless you have some other reason to run that VPN system anyway, the VPN probably has more attack surface than OpenSSH (and, in all likelihood, a worse security record to boot.) Also, consider that if you are running the VPN server on the same system as the SSH daemon, an attacker generally wouldn't need to compromise the SSH daemon after compromising the VPN server - they'd probably already have a root shell just from popping the VPN.