On Wed, Mar 20, 2024 at 04:22:29AM +0800, jeremy ardley wrote: > A 'safer' implementation will not even expose an ssh port. Instead there > will be a certificate based VPN where you first need a certificate to > connect and then you need a separate certificate to log in as root. A > further enhancement of security is to use 2-factor authentication - which is > supported in sshd via pam.
How will a "VPN" with a "certificate" (whatever that means in this context) be more secure than a SSH (assuming key pair authentication, not password)? They are doing the same dance (key exchange, key pair validation, session key establishment) -- the "certificate" part is just a step further (and, BTW, SSH can do that, too), which just eases key management (at the expense of security: you have but one more moving part). The "port" thing stays the same: the VPN server uses a TCP connection, too. Moving the port to a non-standard number, using fail2ban, firewall knocking and those things don't increase security *directly* -- they just remove noise from the logs, which eases the admin's task and thus increase security indirectly. There's no magic. Cheers -- t
signature.asc
Description: PGP signature
