ChipTuner on Nostr: On my main network no. Don't have much choice in cloud. Ideally pubkey only, ...
On my main network no. Don't have much choice in cloud. Ideally pubkey only, different port, and failt2ban. Truly not sure how effective the last two are without a honeypot, but even still that's a lot going on and more software surface area to worry about. VPN when I'm out.
No one ever bother's to explain anything besides tribal thinking or whatever school or their business demands but never shares the data or why.
If VPN access is obtained to my supervisor network it could be more devastating than hitting ssh on a machine that sits in my DMZ network. That said given the option, I would never expose ssh no matter the circumstances of any hypervisor/supervisor machine. They all live in different networks, and I try to limit access for vpn clients but it's hard when I'm away trying to manage hardware.
Something I do for cloud systems that have a managed firewall, I specify my client IP addresses manually. I sometimes also use nginx as a stream tunnel, which allows IP based white/blacklists. I think it also has an SSH tunnel module which probably has even better control. Firewall > nginx though if possible.
Wireguard. Rotate keys fairly often. Typing a portion of the key and copying the rest. Use a pre-shared symmetric key for added protection.
No one ever bother's to explain anything besides tribal thinking or whatever school or their business demands but never shares the data or why.
If VPN access is obtained to my supervisor network it could be more devastating than hitting ssh on a machine that sits in my DMZ network. That said given the option, I would never expose ssh no matter the circumstances of any hypervisor/supervisor machine. They all live in different networks, and I try to limit access for vpn clients but it's hard when I'm away trying to manage hardware.
Something I do for cloud systems that have a managed firewall, I specify my client IP addresses manually. I sometimes also use nginx as a stream tunnel, which allows IP based white/blacklists. I think it also has an SSH tunnel module which probably has even better control. Firewall > nginx though if possible.
Wireguard. Rotate keys fairly often. Typing a portion of the key and copying the rest. Use a pre-shared symmetric key for added protection.