▲ 3 ▼ forwarding port 22 safe? (alien.top) submitted 2 years ago by 1c34@alien.top [B] to c/main@selfhosted.forum 91 comments fedilink hide all child comments i want to remotely ssh to my home server, and I was wondering if I could just forward port 22 with disabling password login and use pubkey authentication will be safe enough?
[–] Karyo_Ten@alien.top [B] 1 point 2 years ago (2 children) But then it's blatantly obvious and you can behavior block. permalink fedilink source parent hideshow 4 child comments replies: [–] nefarious_bumpps@alien.top [B] 1 point 2 years ago Apparently, the downvoters don't understand IPS. permalink fedilink source parent [–] dal8moc@alien.top [B] 1 point 2 years ago (1 child) Which is easily defeated by using one block of ip addresses to gather data and another block for actually trying to exploit found ports. Unless you block the whole AS. If the attacker only uses one system with one ip they probably wouldn’t have the resources to get past ssh anyway. permalink fedilink source parent hideshow 2 child comments replies: [–] Karyo_Ten@alien.top [B] 1 point 2 years ago Behavior blocking can be done across many IPs. If you have one IP that scans port 10000, the other port 10001, and thousands of other IPs scanning just 1 port it's still blatantly obvious. And if they want to scan in a less obvious manner they need to do this spaced by days. permalink fedilink source parent
[–] nefarious_bumpps@alien.top [B] 1 point 2 years ago Apparently, the downvoters don't understand IPS. permalink fedilink source parent
[–] dal8moc@alien.top [B] 1 point 2 years ago (1 child) Which is easily defeated by using one block of ip addresses to gather data and another block for actually trying to exploit found ports. Unless you block the whole AS. If the attacker only uses one system with one ip they probably wouldn’t have the resources to get past ssh anyway. permalink fedilink source parent hideshow 2 child comments replies: [–] Karyo_Ten@alien.top [B] 1 point 2 years ago Behavior blocking can be done across many IPs. If you have one IP that scans port 10000, the other port 10001, and thousands of other IPs scanning just 1 port it's still blatantly obvious. And if they want to scan in a less obvious manner they need to do this spaced by days. permalink fedilink source parent
[–] Karyo_Ten@alien.top [B] 1 point 2 years ago Behavior blocking can be done across many IPs. If you have one IP that scans port 10000, the other port 10001, and thousands of other IPs scanning just 1 port it's still blatantly obvious. And if they want to scan in a less obvious manner they need to do this spaced by days. permalink fedilink source parent