2

I have some VPS servers which I manage through ssh. However there are many ports which I want open during development, therefore I also have OpenVPN on them.

Now I am wondering if it would make sense requiring a OpenVPN connection for ssh access. Is there any practical security advantage on a ssh connection through a VPN (same server) vs a direct ssh access?

4
  • Are these VPS hosted in the cloud? Are there an internal network between them? Jun 20, 2014 at 14:52
  • What do you want to protect against?
    – schroeder
    Jun 20, 2014 at 15:40
  • VPS in the cloud hosting some type of public service. Connection to other VPS servers is done through VPN but to developers only through ssh. I wanted to protect against unauthorized access. Jun 21, 2014 at 4:34
  • The best way to add additional information to your question is by editing it, with the edit button. It is better visible that way, and comments are mainly for secondary, temporary purposes. Comments are removed under a variety of circumstances. Anything important to your question should be in the question itself.
    – guntbert
    Jun 27, 2014 at 6:52

1 Answer 1

3

The first response that comes to mind is: "Only if you want to slow down your SSH sessions even more."

OpenVPN and SSH perform very similar tasks in very similar ways. Assuming that you have set up your SSH in a secure way, you are not increasing your protection against the typical threat scenarios.

That said, if you are extremely paranoid about your encrypted connections getting decrypted (by government alphabet soup, et al.), then tunneling your tunnels might delay them further. But, this threat is the only one that I can imagine that SSH in an OpenVPN tunnel would protect against.

1
  • Agreed, strengthen your SSH server, no password auth (and disable the weak ciphers and macs if your particularly paranoid). I could appreciate VPN if multiple SSH servers were behind that - for layered security, but if scattered... Jun 20, 2014 at 21:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .