• 52 Posts
  • 501 Comments
Joined 2 years ago
cake
Cake day: June 20th, 2023

help-circle







  • callcctoSelfhostedHow to harden against SSH brute-forcing?
    link
    fedilink
    English
    arrow-up
    1
    ·
    13 days ago

    Ok, fair point. But why stop at one vpn? I choose to trust OpenSSH, but I agree that adding a secondary layer of security actually helps here. You basically multiply two very low probabilities to get an even lower one. The trade-off is that you add complexity. You now need to keep two services up to date, and correctly configured and access/key material distributed.

    I’d only recommend this setup for projects with special security requirements.





  • callcctoSelfhostedHow to harden against SSH brute-forcing?
    link
    fedilink
    English
    arrow-up
    3
    arrow-down
    7
    ·
    14 days ago

    Welcome to the internet! Your system will get probed. Make sure you run as little as possible services on open ports and only high quality ones such as OpenSSH. Don’t freak out because of your logs. You’re fine as long as your system is up to date and password login disabled! Don’t listen to the fail2ban or VPN crowd. Those are only snake oil.

    A VPN is probably just as (in)secure as OpenSSH. There is no gain in complicating things. OpenSSH is probably one of the most well tested code for security around.