undefined | Better HN

0 pointstechcode1y ago0 comments

Instead of rate limiting, more than a decade ago I started simply changing SSH port from 22 to something else.

In case I needed to proxy through home, or access something like web ui for home heating system - I simply used ssh tunnel (socks localhost etc)...

Of course now all that is simply done via WireGuard/Tailscale/etc.

0 comments

I'd even go one step further and say portknocking would do a lot of good too, in addition to changing the default SSH port.

If anyone actually does this - please have a backup for the time when either Fail2Ban or/and PortKnocking (so both) fail or lock you out.

I've never had knockd fail me, can you fill me in on what pitfall got yours to go down? Just in case.

j / k navigate · click thread line to collapse

0 pointstechcode1y ago0 comments

Instead of rate limiting, more than a decade ago I started simply changing SSH port from 22 to something else.

In case I needed to proxy through home, or access something like web ui for home heating system - I simply used ssh tunnel (socks localhost etc)...

Of course now all that is simply done via WireGuard/Tailscale/etc.

I'd even go one step further and say portknocking would do a lot of good too, in addition to changing the default SSH port.

If anyone actually does this - please have a backup for the time when either Fail2Ban or/and PortKnocking (so both) fail or lock you out.

I've never had knockd fail me, can you fill me in on what pitfall got yours to go down? Just in case.

j / k navigate · click thread line to collapse