3 ms·

Thanks, this was a good answer. Yes, I am going to want to use SSH in the end, the console is typically what I want, potentially with a single port forwarded (8

by dagss 11y ago

Thanks, this was a good answer. Yes, I am going to want to use SSH in the end, the console is typically what I want, potentially with a single port forwarded (8080 or whatnot), so I guess the question really comes down to "is there any reason to believe there are more exploits in OpenSSH than in VPN", and possibly also "is it so hard to configure and keep updated a Linux box with OpenSSH correctly that it is better to go with VPN".

zaroth 11y ago
OpenSSH has had critical vulnerabilities in the early 2000's, but it's held up extremely well the last 10 years. OpenVPN has a significantly higher attack surface, especially if you consider things like XSRF on the Admin GUI. You'll almost certainly need a hardened and updated OpenSSH in any case, so using a VPN can only possibly increase your attack surface. My own opinion is if you have few enough servers and no other reason for a VPN, then expose SSH on a non-standard port or use a port knocker, and use something like this article's MFA solution. The non-standard port or port knocking is really just to keep spam out of your logs. Since authentication requires a 4096 bit private key, you're not worried about brute force in any case.