Selfhosted

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

7 acronyms in this thread; the most compressed thread commented on today has 8 acronyms.

[Thread #42 for this sub, first seen 14th Aug 2023, 15:55] [FAQ] [Full list] [Contact] [Source code]

Public key auth, and fail2ban on an extremely strict mode with scaling bantime works well enough for me to leave 22 open.

Fail2ban will ban people for even checking if the port is open.

You really shouldn't have something kike SSHD open to the world, that's just an unnecessary atrack surface. Instead, run a VPN on the server (or even one for a network if you have several servers on one subnet), connect to that then ssh to your server. The advantage is that a well setup VPN simply won't respond to an invalid connection, and to an attacker, looks just like the firewall dropping the packet. Wireguard is good for this, and easy to configure. OpenVPN is pretty solid too.

I’ll take that tiny amount of traffic telling scanners there’s no password auth over having to remember port settings for ssh, scp and rsync any day.

Or, you know, just use key auth only and fail2ban. Putting sshd behind another port only buys you a little time.

I opened a raw text channel on the Telnet port for a personal game engine project and someone tried to enable commands and do some shady stuff. Unfortunately for them, that's not a valid chess move.

Just do it properly and configure sshd securely. When you have a machine exposed to the internet, you should expect it to be attacked. If you really want to give the finger to bots, run endlessh on port 22 and keep sshd on a non-standard port. Stay safe.

10mb is pretty much nothing. May as well just use Fail2Ban.

I get what you say, and you're definitely not wrong to do it. But as I see it, you only saved ~80Kib of ingress and a few lines of logs in the end. From my monitoring I get ~5000 failed auth per day, which account for less than 1Mbps average bandwidth for the day.

It's not like it's consuming my 1Gbps bandwidth or threatening me as I enforce ssh key login. I like to keep things simple, and ssh on port 22 over internet makes it easy to access my boxes from anywhere.

I'd favour own VPN instead of relying on an additional third party

If you do want to open 22, and there are plenty of good reasons to want to, just implement something called port knocking and you can do it safely.

Note with this you still need good authentication. That means no passwords, key based auth only.

I am not in IT, what does this mean ?

Now try IPv6 only :P

ITT: People who don't understand Tailscale or are allergic to it for 'reasons'

As others have already said, set up a VPN like wireguard, connect to the VPN and then SSH to the server. No need to open ports for SSH.

I do have port 22 open on my network, but it's forwarded to an SSH tarpit: https://github.com/skeeto/endlessh

I don't get tailscale? In-kernel Wireguard is easy to setup. What does it add to this?

And yet it is more likely that tailscale get owned since the reward is much higher. I take my chances with my secured openssh server at port 22 vs a 3rd party company who controlls the access.

I don't know if it was mentioned already but how could I check if my ports are under "attack"? OPs graphic looks really nice

For management ports, I set up a firewall on the VPS to only respond to connections from known IPs.