Absolutely, but I prefer not to leave 22/tcp open to the world. If I do leave it open it is only from a restricted IP set, otherwise it is behind a VPN, probably OpenVPN.
Re:Practical Linux Hardening Guide
by closeparen on Thursday January 24, 2019 @11:15PM
(#18995520)
Is OpenVPN a safer attack surface compared to OpenSSH?
Re:Practical Linux Hardening Guide
by romeisendcoming on Monday January 28, 2019 @01:16PM
(#19019675)
Sure, especially when you VPN into a sacrificial subnet and need MFA to continue elsewhere into locked down application domains. OTOH I would leave ssh listening on a non-descript high port with MFA (key and OTP) enabled. No use worrying too much about that.
Re:Practical Linux Hardening Guide
by amdavidson on Friday January 25, 2019 @03:31PM
(#19002209)
Is OpenSSH safer when used in addition to OpenVPN?
Probably.
Re:Practical Linux Hardening Guide
by aaronmdjones on Friday January 25, 2019 @10:27AM
(#18998727)
I doubt it.
ssh keys instead of passwords are a good example of better security and more convenience (for the most common use cases).
It'd be nice if more "security improvements" came with ways to make them convenience improvements too...