• taaz@biglemmowski.win
    link
    fedilink
    English
    arrow-up
    12
    arrow-down
    2
    ·
    edit-2
    6 months ago

    I wouldn’t recommend putting ssh behind any vpn connection unles you have a secondary access to the machine (for example virtual tty/terminal from your provider or local network ssh). At best, ssh should be the only publicly accessible service (unless hosting other services that need to be public accessible).

    I usually move the ssh port to some higher number just to get rid of the basic scanners/skiddies.

    Also disable password login (only keys) and no root login.

    And for extra hardening, explicitly allow ssh for only users that need it (in sshd config).

    • Poutinetown@lemmy.ca
      link
      fedilink
      English
      arrow-up
      8
      ·
      6 months ago

      Ssh behind a wire guard VPN server is technically more secure if you don’t have a key-only login, but a pain if the container goes down or if you need to access the server without access to wireguards VPN client on your device.

      • Lem453@lemmy.ca
        link
        fedilink
        English
        arrow-up
        10
        ·
        edit-2
        6 months ago

        Highly recommend getting a router that can accept wireguard connections. If the router goes down you’re not accessing anything anyways.

        Then always put ssh behind the wireguard connections.

        For a homelab, there is rarely a need to expose ssh directly so best practice will always be to have multi layered security when possible.

        • Poutinetown@lemmy.ca
          link
          fedilink
          English
          arrow-up
          4
          ·
          6 months ago

          Yeah it’s good to have a system separate from the main server. It’s always so frustrating having to debug wireguard issues cause there’s some problem with docker