4 ms·
Nice. The deadline argument concept is smart and not in many other implementations. It seems there are two sides of the spectrum for secure SSH access: + Rel
by gz5 2y ago
Nice. The deadline argument concept is smart and not in many other implementations.
It seems there are two sides of the spectrum for secure SSH access:
+ Relatively infrequent access by limited # of people to servers which are not top targets for attacks. Solutions like the one above are great for this.
+ More frequent, more users, more sensitive servers. Close all the inbound ports, permanently.
Example: https://github.com/openziti-test-kitchen/zssh https://github.com/openziti-test-kitchen/zssh (or with an integrated OIDC like KeyCloak - https://youtu.be/NZJtzSoS_g0?si=Qg6p6Hdkaq1ahefg https://youtu.be/NZJtzSoS_g0?si=Qg6p6Hdkaq1ahefg)
- mrbluecoat 2y agoI agree. Instead of closing port 22 only to open a different port, it seems more secure to close all ports like the zssh example above or Tailscale SSH [1] or SSH No Ports [2]. [1] https://tailscale.com/tailscale-ssh https://tailscale.com/tailscale-ssh [2] https://atsign.com/resources/articles/close-port-22-forever-with-ssh-no-ports/ https://atsign.com/resources/articles/close-port-22-forever-...
- 0cf8612b2e1e 2y agoSSH on something other than port 22 is not more secure, but it does massively reduce the amount of log noise. Which I find invaluable since I do not have a security team monitoring my machines.
- mschempp 2y ago"+ Relatively infrequent access by limited # of people to servers which are not top targets for attacks. Solutions like the one above are great for this." Thats exactly what I'm using it for - I'm the only one on my server :)