3 ms·

If one self hosts a VPN, are there any security benefits over properly configured SSH? I assume you must have to have an IP address somewhere. Bad guys will be

If one self hosts a VPN, are there any security benefits over properly configured SSH? I assume you must have to have an IP address somewhere. Bad guys will be scanning that I assume. If the key is to use a managed VPN service, what magic are they adding? Legitimate question. I assume there might be a benefit, I'm just not sure what it is.

nine_k 2y ago
It depends, I think, on the complexity of the VPN. SSH allows to do so many things, has so many config options. To the opposite, Wireguard is very simple, allows basically one thing (authenticate by a key, then pass packets), and is much harder to misconfigure. (OpenVPN, on the other hand, does not have this advantage.)
- osigurdson 2y ago
  If true, interesting that it all comes down to likelihood of misconfiguration. However, I can't see anything fundamental that a VPN adds either. I wonder, if there was an ssh that couldn't be configured incorrectly and also had a little "anti-hack" tech built in (e.g. disallow more than N connection attempts per minute, etc., what ever is normally done).
  - nine_k 2y ago
    After authnz, SSH runs a shell (or other specified remote program), while Wireguard just sets up a network interface. I think it's really hard to make Wireguard run something remotely as you connect, AFAICT. You can achieve a somehow similar result running by OpenSSH as `ssh -N -D`: do not run anything on the remote end, work as a socks5 proxy.
    - immibis 2y ago
      ssh -w sets up a network interface ssh -w -N sets up a network interface and does not run a shell It still runs over TCP, so it's not ideal. TCP-over-TCP is a recognized antipattern that causes extra retransmissions, wasted bandwidth and delays.
m3047 2y ago
Other options include port knocking and "no cat" (a web or email interface which selectively pokes holes for ssh based on magic incantations).

nine_k 2y ago

It depends, I think, on the complexity of the VPN. SSH allows to do so many things, has so many config options. To the opposite, Wireguard is very simple, allows basically one thing (authenticate by a key, then pass packets), and is much harder to misconfigure. (OpenVPN, on the other hand, does not have this advantage.)

osigurdson 2y ago
If true, interesting that it all comes down to likelihood of misconfiguration. However, I can't see anything fundamental that a VPN adds either. I wonder, if there was an ssh that couldn't be configured incorrectly and also had a little "anti-hack" tech built in (e.g. disallow more than N connection attempts per minute, etc., what ever is normally done).
- nine_k 2y ago
  After authnz, SSH runs a shell (or other specified remote program), while Wireguard just sets up a network interface. I think it's really hard to make Wireguard run something remotely as you connect, AFAICT. You can achieve a somehow similar result running by OpenSSH as `ssh -N -D`: do not run anything on the remote end, work as a socks5 proxy.
  - immibis 2y ago
    ssh -w sets up a network interface ssh -w -N sets up a network interface and does not run a shell It still runs over TCP, so it's not ideal. TCP-over-TCP is a recognized antipattern that causes extra retransmissions, wasted bandwidth and delays.

m3047 2y ago

Other options include port knocking and "no cat" (a web or email interface which selectively pokes holes for ssh based on magic incantations).