[axegon_]

I have a few dozen such things at home. My absolute favorite one though is a bit wild. I am a bit of a security freak. I do however on occasion need to access something on my home network and I also need some redundancy(it wouldn't be the first time my only solution fails and I need a backup). So I use an old raspberry pi as an ssh server with port forwarding with all gimmicks in place(no root, private key only and all that). Whenever I(or hypothetically someone else logs in) I get a notification on my phone so I can react quickly if needed. I can immediately kick them out by simply replying to the notification. BUT... Redundancy is a good thing, so I also have a kill switch:

I have an ESP32 with a sim card and a relay which is controlling the plug to my router. Should I end up being locked out, while someone else has managed to get in, I can send a specific text to a specific number and the esp will kill the power to the router.

Overkill? Considering no one has ever managed to get in, probably. But it's better to have the option than not.

[mikeodds]

Just because you’re paranoid doesn’t mean they’re not out to get you

[axegon_]

Oh, I know... There are over 3k login attempts per day. As a matter of fact I started writing an article about it but time constraints + I don't always have the motivation when I do find time. Some day...

[PrimeMcFly]

Just firewall off most of the world when you won't be accessing your server from there.

Also look at fail2ban. Maybe portknocking also.

[bonton89]

What are the monthly fees on the sim card, or is part of an existing cell plan?

[axegon_]

It's part of my plan so this card in particular is just under 12 bucks a year. But I have 4 sim cards in total: Phone with everything unlimited + another one for backup + one that's data only + the one I have hooked up to the esp. But we are talking about a tiny country in south-east Europe so the fees aren't exactly comparable to central/western Europe or north America.

[beembeem]

I love this. With a bit more free time and experience this would be me.

[firecall]

Have you considered Tailscale or DIY Wireguard?

[axegon_]

The ssh access server is one way to get in, as I said, redundancy....

[PrimeMcFly]

It's unlikely someone could bypass SSH key auth and the phone number thing seems lie it could be used against you more than it would ever be useful.