7 ms·
I used to run SSH over some port != 22, does the trick to some degree. After I picked up a Cisco ASA, went back to standard port 22 but only allow access for c
by virtualwhys 13y ago
I used to run SSH over some port != 22, does the trick to some degree.
After I picked up a Cisco ASA, went back to standard port 22 but only allow access for connected VPN users.
Of course if the ASA goes down, so does the entire network, yelp. SmartNET contract/warranty comes in handy, and the data center having backup ASAs on site for quick swap is pretty useful as well.
- Qantourisc 13y agoThis doesn't make it secure, but this DOES save a lot on having a log full with login attempts from all kinds of IP addresses.
- tsahyt 13y agoWhen I set up my first server I was thoroughly surprised at the amount of login attempts. By now I've got most of Asia on a blacklist for port 22 (which doesn't matter, since I'm not going to connect to my server from an Asian IP in the foreseeable future). That throttled it down to about 30 attempts/week, which is manageable in terms of log reading.
- virtualwhys 13y agoExcuse me? How is VPN not secure? The ASA won't let any traffic through on port 22, period. You have to be connected over VPN in order to even attempt SSH access to servers behind the ASA.
- justincormack 13y agoOf course Cisco is at the top of the NSA insert backdoors list one assumes.