News for hackers. Stuff that matters.

A comment on Access for Infrastructure: SSH. Parent comment

Re:Access for Infrastructure: SSH by artificialLimbs on Wednesday October 23, 2024 @11:03PM (#41931515)
I don’t understand why this is more secure than limiting SSH to local network only and doing ‘normal’ ssh hardening.
[ Parent | on HN ]
Re:Access for Infrastructure: SSH by candiddevmike on Thursday October 24, 2024 @07:36AM (#41934522)
None of that is required here? Etcha can be exposed on the Internet with a smaller risk profile than SSH:

- Sane, secure defaults

- HTTP-based--no fingerprinting, requires the correct path (which can be another secret), plays nicely with reverse proxies and forwarders (no need for jump boxes)

- Rate limited by default

- Only works with PKI auth

- Clients verify/validate HTTPS certificates, no need for SSHFP records.

[ Parent | on HN ]