4 ms·
In theory. In the same theory, someone would need your EC SSH key to do anything with an exposed SSH port. Practice is a separate question.
by eqvinox 10mo ago
In theory.
In the same theory, someone would need your EC SSH key to do anything with an exposed SSH port.
Practice is a separate question.
- bjt12345 10mo agoSSH is TCP though and the outside world can initiate a handshake, the point being that wireguard silently discards unauthenticated traffic - there's no way they can know the port is open for listening.
- eqvinox 10mo agoUh, you know you can scan UDP ports just fine, right? Hosts reply with an ICMP destination unreachable / port unreachable (3/3 in IPv4, 1/4 in IPv6) if the port is closed. Discarding packets won't send that ICMP error. It's slow to scan due to ICMP ratelimiting, but you can parallelize. (Sure, you can disable / firewall drop that ICMP error… but then you can do the same thing with TCP RSTs.)
- apstls 10mo agoThat's why you discard ICMP errors.
- eqvinox 10mo agoIf anything, that's why you discard ICMP port unreachable, which I assume you meant. If you're blanket dropping all ICMP errors, you're breaking PMTUD. There's a special place reserved in hell for that. (And if you're firewalling your ICMP, why aren't you firewalling TCP?)
- JasonADrury 10mo agoNot even remotely comparable. Wireguard is explicitly designed to not allow unauthenticated users to do anything, whereas SSH is explicitly designed to allow unauthenticated users to do a whole lot of things.
- eqvinox 10mo ago> SSH is explicitly designed to allow unauthenticated users to do a whole lot of things I'm sorry, what?