115
SSH Hardening with ssh-audit (thoughts.greyh.at)
submitted 2 years ago by to c/linux@lemmy.ml
13 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 4 points 2 years ago (2 children)

Personally I made sure SSH is only accessible when connected through a VPN setup for that purpose. As in, that same machine hosts a Wireguard setup (through Tailscale) and you need to connect to that first before SSH is available. And then SSH also only accepts key-based authentication. I don't think I need more than that?

  • permalink
  • fedilink
  • source
  • hideshow 4 child comments
    •
  • [–] 3 points 2 years ago (2 children)

    What if wireguard has issues? Then you cant ssh in to fix

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 2 years ago

    I have a VPS that runs the main proxy which I can always access via a console on the website of the company I'm renting it from (Hetzner). The other machines run locally in my home so I can just plug in a cable if need be.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 1 point 2 years ago (2 children)

    Couldn't you just use ssh port forwarding?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 2 years ago

    Sure but I rather not have the SSH port open to the world, it just makes it harder for attackers to get in this way. Besides I use the VPN for more things, some self-hosted services I don't want accessible by the whole world.

  • permalink
  • fedilink
  • source
  • parent