0

For my own (public) servers, is it considered a good idea to only allow ssh connections from VPN connections (OpenVPN, Wireguard or otherwise), to mitigate any possible attacks in the future on ssh?

It seems that ssh is constantly under attack. This is how I'm thinking about this. Am I missing something in this thought process?

Improve this question
8
  • "Does adding an authentication layer before another authentication layer add an effective layer of security to the latter authentication layer to ensure that only authenticated connections are made?" -- uh, yes? It just doesn't protect you from malicious acts performed by an authenticated connection.
    – schroeder ♦
    Commented Apr 3 at 11:44
  • 1
    The XZ backdoor allows an attacker to connect to the server through SSH and bypass SSH authentication in doing so. One way to mitigate this attack is to use a firewall to limit SSH's exposure, by only allowing connections from a limited set of IP addresses. This way, an attacker coming from a blocked IP address would not even be able to make an SSH connection to the server. Restricting access to only the VPN would have the same effect.
    – mti2935
    Commented Apr 3 at 11:52
  • 1
    so, "does an imperfect security layer add more security?" is that what you want to ask? The answer is still "yes" because imperfect security is not perfectly imperfect. All security layers are imperfect (that's why we layer them). That's not an "easy answer"; that's the reality of things because digital technology is complex... Take a tour through the Cynefin model. While we like to think that things as well-known as SSH are in the "Clear" domain, we find, like in this XZ example, that they are Complex. Hence, layers.
    – schroeder ♦
    Commented Apr 3 at 12:43
  • 1
    "Is it a good idea to layer controls?" -- Yes. "Does adding layers introduce their own weaknesses?" -- also yes. So, what exactly do you want to ask? What you have asked in your question appears obvious. If you are wanting "comprehensive" you will need to define what you are looking for.
    – schroeder ♦
    Commented Apr 3 at 12:46
  • 2
    @TheQuantumPhysicist: "It seems that ssh is constantly under attack." - as is any other internet facing service, including VPN.
    – Steffen Ullrich
    Commented Apr 3 at 12:51

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .