Ask HN: How can I secure my AWS instance's SSH access if I have no static IP?

Re:Ask HN: How can I secure my AWS instance's SSH access if ... by iiix on Friday February 18, 2022 @02:39AM (#30383116)

You could try using Tailscale. It's a wireguard based mesh VPN. Just set it up on your device, your server, and you're good to go. You can just only allow SSH over Tailscale, without worrying about anybody else trying to get in.

Other alternatives include ZeroTier and Nebula afaik, but I've never tried either.

(Still use SSH keys regardless though.)

[ Parent | on HN ]

Re:Ask HN: How can I secure my AWS instance's SSH access if ... by Anunayj on Friday February 18, 2022 @03:17AM (#30383326)

Personally I don't think there is any merit of using tailscale over just public key auth. The way that can go wrong is if there is a vulnerability in sshd, which would be well disastrous.

[ Parent | on HN ]

Re:Ask HN: How can I secure my AWS instance's SSH access if ... by vero2 on Friday February 18, 2022 @03:03AM (#30383251)

Zerotier is the easy way around. Also remember to block all ssh access at standard ports.

[ Parent | on HN ]

Re:Ask HN: How can I secure my AWS instance's SSH access if ... by the_biot on Friday February 18, 2022 @04:14AM (#30383665)

That implies running SSH on another, non-standard port makes it safer -- when a simple port scan would reveal it. It's a classic security through obscurity fallacy, IMHO,

[ Parent | on HN ]

Re:Ask HN: How can I secure my AWS instance's SSH access if ... by vero2 on Friday February 18, 2022 @06:25AM (#30384431)

I did not say/imply that the user should implement a ONLY non-standard port as security.

Sure " simple port scan would reveal it" - but for those other script kiddes that do not do have it prevents it. And BTW, every bit helps of security helps. zerotier at an alternative port is slightly better than port 22.

[ Parent | on HN ]