I've set up different port than default to access remote server via SSH and also disabled password login (pubkey enabled), in /etc/hosts.deny enabled ALL: PARANOID. Anything more to increase security or is this enough?
@nikolal@m10q I have a nice set-up where SSH is only available on the WireGuard interface, via an Authenticated Tor Hidden Service, or using port-knocking.
Usually use the WireGuard one, the otehr two are failsafes.
@rysiek@nikolal@m10q I ended up exposing SSH on Yggdrasil network interface only; Tor is anonymous which is not what I need for SSH logins, while Yggdrasil is distributed and encrypted but not anonymous
@kravietz@nikolal@m10q correct, but the "security cookie" is basically a pre-shared key. I.e. only the Tor client explicitly configured to have that particular "cookie" (it's Tor-client-level, not browser-level) will have it.
@kravietz @nikolal @m10q correct, but the "security cookie" is basically a pre-shared key. I.e. only the Tor client explicitly configured to have that particular "cookie" (it's Tor-client-level, not browser-level) will have it.