Detect if you are running a known-vulnerable version of OpenSSH, which wouldn't be an issue if you keep good patch hygiene and install your SSH server through you operating systems' package manager
Scripting, to confirm that a large fleet of boxes are all running according to your policy. Verification that the config you want is actually the config you have.
Personally I made sure SSH is only accessible when connected through a VPN setup for that purpose. As in, that same machine hosts a Wireguard setup (through Tailscale) and you need to connect to that first before SSH is available. And then SSH also only accepts key-based authentication. I don't think I need more than that?
I have a VPS that runs the main proxy which I can always access via a console on the website of the company I'm renting it from (Hetzner). The other machines run locally in my home so I can just plug in a cable if need be.
Sure but I rather not have the SSH port open to the world, it just makes it harder for attackers to get in this way. Besides I use the VPN for more things, some self-hosted services I don't want accessible by the whole world.
12 Comments
taaz@biglemmowski.win · 14 pts · 2y
Also this: https://words.filippo.io/ssh-whoami-filippo-io/
zquestz@lemm.ee · 2 pts · 2y
Fun, I didn't know about this. =)
blarp@lemmy.ml · 9 pts · 2y
RegalPotoo@lemmy.world · 7 pts · 2y
Cool,.but from the post it seems like all it does is:
So what's the point? Who is this for?
jwhardcastle@dmv.social · 14 pts · 2y
Scripting, to confirm that a large fleet of boxes are all running according to your policy. Verification that the config you want is actually the config you have.
lemann@lemmy.one · 3 pts · 2y
This is exactly what I use it for 👌 very handy for this
PureTryOut@lemmy.kde.social · 4 pts · 2y
Personally I made sure SSH is only accessible when connected through a VPN setup for that purpose. As in, that same machine hosts a Wireguard setup (through Tailscale) and you need to connect to that first before SSH is available. And then SSH also only accepts key-based authentication. I don't think I need more than that?
9488fcea02a9@sh.itjust.works · 3 pts · 2y
What if wireguard has issues? Then you cant ssh in to fix
sturmblast@lemmy.world · 2 pts · 2y
that really just depends on your scenario
PureTryOut@lemmy.kde.social · 1 pts · 2y
I have a VPS that runs the main proxy which I can always access via a console on the website of the company I'm renting it from (Hetzner). The other machines run locally in my home so I can just plug in a cable if need be.
possiblylinux127@lemmy.zip · 1 pts · 2y
Couldn't you just use ssh port forwarding?
PureTryOut@lemmy.kde.social · 1 pts · 2y
Sure but I rather not have the SSH port open to the world, it just makes it harder for attackers to get in this way. Besides I use the VPN for more things, some self-hosted services I don't want accessible by the whole world.
iuser@lemmy.world · 3 pts · 2y
Thanks for pushing the awareness.