Security by obscurity is underrated

Re:Security by obscurity is underrated by magicalhippo on Friday September 11, 2020 @09:01PM (#24448940)

No because I have a firewall in front of the SSH, as mentioned. I would assume a firewall is in front of the VPN as well of course.

So either only SSH is exposed to the public, or only VPN is exposed. Without an additional firewall after the VPN, how is my LAN more protected with the VPN vs SSH?

[ Parent | on HN ]

Re:Security by obscurity is underrated by cthalupa on Friday September 11, 2020 @09:24PM (#24449051)

Your goal is to protect SSH, not the VPN network. The VPN network is just a tool for protecting SSH.

With your configuration, all that needs to exist is an SSH 0 day to gain access to the server. With a VPN, they need that AND a 0 day for the VPN software to gain access to the server.

You can have a more complex setup with a VPN, but that isn't the discussion here - the discussion is securing SSH. If you want to provide VPN access to an array of other services, or as access to a corporate LAN or similar, then that's another conversation that has to involve the specifics of those services and that configuration. It's not what is being recommended here.

[ Parent | on HN ]

Re:Security by obscurity is underrated by magicalhippo on Saturday September 12, 2020 @04:29AM (#24450888)

Fair enough, guess I was restricting my view to my bubble. For a single server sure defense in depth should work, assuming you're not running the VPN on the same box.

[ Parent | on HN ]