3 ms·
After the xz backdoor a few months ago, I decided to turn off SSH everywhere I don't need it, either by disabling it or uninstalling it entirely. While SSH is q
by poikroequ 2y ago
After the xz backdoor a few months ago, I decided to turn off SSH everywhere I don't need it, either by disabling it or uninstalling it entirely. While SSH is quite secure, it's too lucrative a target, so it will always pose a risk.
- lupusreal 2y agoI now only bind services to wireguard interfaces. The bet is that a compromise in both the service and wireguard at the same time is unlikely (and I have relatively high confidence in wireguard.)
- devsda 2y agoI'm confident in making ssh changes while logged in via ssh. Compared to ssh, wireguard configs feel too easy to mess up and risk getting locked out if its the only way of accessing the device.
- pja 2y agoUse tailscale instead? It’s user friendly enough that you’re unlikely to mess it up.
- someplaceguy 2y ago> The bet is that a compromise in both the service and wireguard at the same time is unlikely An RCE in wireguard would be enough -- no need to compromise both.
- remram 2y agoI was going to say something like this, but in practice wireguard is very very tiny. It doesn't have pluggable authentication, or passwords, or user transitions, or forked subprocesses, or systemd integrations. Using it or another simple secure transport in front of SSH is probably a good idea.
- someplaceguy 2y agoI don't disagree with you. However, my point was that the parent poster's reasoning was flawed. Stacking these services on top of each other in this way does not necessarily mean that an attacker has to compromise both services in order to compromise a host. The parent poster's flawed reasoning appeared to lead to a false sense of security as a result.
- remram 2y agoYes for sure. An RCE in the first is sufficient, or an auth bypass in the first and some other vulnerability in the second.
- rwmj 2y agoSo .. how do you handle remote logins?
- daneel_w 2y ago"everywhere I don't need it" likely implies computers he or she only accesses directly on the console.
- kraftverk_ 2y agoWhat do you use in place of it?
- daneel_w 2y agoA keyboard and a display, aka "the console". For example when using one's laptop or sitting at their stationary PC.
- password4321 2y agohttps://www.aurga.com/ https://www.aurga.com/ ? Because an $80 black box wireless KVM from a foreign country is way more secure! (Just kidding, though it is not internet-accesible by default.)