Re:Ask HN: How do you continuously monitor web logs for hack...
by tptacek on Tuesday May 08, 2018 @09:54AM
(#17020863)
In an ideal world, literally no SSH at all. That's doable in container cattle fleet networks.
In a realistically achievable world for virtually every startup, no routable SSH. No security rule allows 22/tcp from a routable address into a VPC. You want to SSH into a host, you VPN to your network first. This is how most organizations with security teams set up SSH.
If you can't get there, at least get to jump box SSH --- 22/tcp is allowed to exactly one isolated host from the outside world (some people filter source addresses to their jump boxes, I don't bother); to get to real hosts, you bounce through that one.
A network where you can randomly connect to the sshd on real servers is one most security professionals will assume isn't being run competently.
In a realistically achievable world for virtually every startup, no routable SSH. No security rule allows 22/tcp from a routable address into a VPC. You want to SSH into a host, you VPN to your network first. This is how most organizations with security teams set up SSH.
If you can't get there, at least get to jump box SSH --- 22/tcp is allowed to exactly one isolated host from the outside world (some people filter source addresses to their jump boxes, I don't bother); to get to real hosts, you bounce through that one.
A network where you can randomly connect to the sshd on real servers is one most security professionals will assume isn't being run competently.