Without root user login, the attacker would have to guess not only the password to the user but also the username (hopefully it's not something simple like admin), and once you are logged in you can use sudo -i to chage into root, which will require a password, therefore, we also disable password login so if someone does manage to somehow compromise the SSH user, they'd still need the password to become root.
Guiorgy
joined 2 weeks ago
You could spin a publicly exposed WireGuard daemon firewalled to allow peers access to the non-public SSH port only, which would result in double encryption, but would give you the peace of mind that an attacker would have to compromise both at the same time, which is very unlikely. Plus, WireGuard is very cheap to deploy and produces no logs. We use that model in my office to access our server.
Edit: Otherwise, as others mentioned, you'd move the SSH daemon to a random port, disable password login and weaker keys and cyphers, setup Fail2ban, and optionally setup GeoIP blocking (only allow IPs from your region to connect).
Not in the US, at work we pay 6 times the rate I pay at home for 1/6 the speed I get at home, everyone hates our office internet speed 😂, at least it's static do we can host stuff
Either use a dynamic DNS service, as many others have mentioned and probably easiest, or, assuming you only want yourself to have access to the services, another option is to use something like Tailscale or a WireGuard/FRP instance in a static VPS as the rendezvous point.
I was flat out rejected by my ISP to have a static IP, though I only had it changed once since I started hosting services, so ahatever.
Yep, my network was set up before the ISPs here merged by a smaller one that did things simpler, so I dont even have an ISP modem, just my OpenWRT router and no CGNAT, and I've only had my IP change once so far (since I started caring about it at least). Everything newer around uses ISP modems and are behind CGNAT, on my mates modem, they wouldn't even let him set up his Wi-Fi, he had to go with double NAT-ing and setting 2 APs next to each other (the ISP modem/router has some default trash Wi-Fi). I'm praying they never bother coming to me 🙏
Never expose the bare remote control endpoint publicly. For example, recently macOS had a critical vulnerability where an attacker could completely bypass authentication on their Screen Sharing daemon, and the researcher had estimates around 40k publicly exposed systems, and it was found out that the vulnerability was in fact being used in the wild. Exposing things like that publicly is asking for trouble.
Personally I don't like relying on 3rd party systems like Tailscale, so I just have a WireGuard peer running firewalled to only allow access to what is necessary, though you can skip the firewall part. This obviously assumes you have a routable public IP, i.e. no CGNAT, if that's not the case Tailscale is probably what you want.
The way a reverse proxy works is to literally stand in the middle of a connection, so either side only sees them communicating with the proxy, oblivious to the actual endpoint. The only "solution" to this, though it's more of a hack really, is to somehow send the original IP as additional data in a way that both sides agree on, e.g. the X-Forwarded-For header as others have mentioned, however, as I've said, both sides need to support and aggree with that, so you may have to find a setting/config to enable on the services behind the proxy. Think of it this way, if services blindly trusted that header and you weren't using a reverse proxy, a bad actor could send a request to your service with that header included thereby spoofing their identity in your logs, therefore, this kind of thing is usually opt-in
Did you read it to the end?