Hacker News new | ask | show | jobs
by formerly_proven 1660 days ago
Some people recommend running a VPN server and then using SSH over VPN for "improved security", but pretty much every VPN apart from WireGuard has a pretty poor track record there.

SSH is in all likelihood the most secure server software that you can have on a Linux box. Everything else you put in front of it is likely to be a downgrade.
1 comments
hn_throwaway_69 1660 days ago
As you essentially say, WireGuard is great. I firewall off direct SSH and first use WireGuard to connect to the server instead.

One advantage is that if your firewall is setup right it's completely invisible, as unauthenticated UDP packets are dropped, as is the case with any other, unused, UDP port.

I still configure SSH to best practices just in case a configuration blunder inadvertently causes the firewall to accept connections.

link