In the past two weeks I set up a new VPS, and I run a small experiment. I share the results for those who are curious.

Consider that this is a backup server only, meaning that there is no outgoing traffic unless a backup is actually to be recovered, or as we will see, because of sshd.

I initially left the standard “port 22 open to the world” for 4-5 days, I then moved sshd to a different port (still open to the whole world), and finally I closed everything and turned on tailscale. You find a visualization of the resulting egress traffic in the image. Different colors are different areas of the world. Ignore the orange spikes which were my own ssh connections to set up stuff.

Main points:

  • there were about 10 Mb of egress per day due just to sshd answering to scanners. Not to mention the cluttering of access logs.

  • moving to a non standard port is reasonably sufficient to avoid traffic and log cluttering even without IP restrictions

  • Tailscale causes a bit of traffic, negligible of course, but continuous.

  • Decronym@lemmy.decronym.xyzBEnglish
    3·
    4 months ago

    Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

    Fewer Letters More Letters
    DNS Domain Name Service/System
    HTTP Hypertext Transfer Protocol, the Web
    IP Internet Protocol
    SSH Secure Shell for remote terminal access
    UDP User Datagram Protocol, for real-time communications
    VPN Virtual Private Network
    VPS Virtual Private Server (opposed to shared hosting)
    nginx Popular HTTP server

    7 acronyms in this thread; the most compressed thread commented on today has 8 acronyms.

    [Thread #42 for this sub, first seen 14th Aug 2023, 15:55] [FAQ] [Full list] [Contact] [Source code]

  • James@lemmy.caEnglish
    2·
    1 year ago

    Public key auth, and fail2ban on an extremely strict mode with scaling bantime works well enough for me to leave 22 open.

    Fail2ban will ban people for even checking if the port is open.

  • u_tamtam@programming.devEnglish
    1·
    1 year ago

    Or, you know, just use key auth only and fail2ban. Putting sshd behind another port only buys you a little time.

  • Clou42@feddit.deEnglish
    1·
    1 year ago

    I’ll take that tiny amount of traffic telling scanners there’s no password auth over having to remember port settings for ssh, scp and rsync any day.

  • elscallr@lemmy.worldEnglish
    0·
    1 year ago

    If you do want to open 22, and there are plenty of good reasons to want to, just implement something called port knocking and you can do it safely.

    Note with this you still need good authentication. That means no passwords, key based auth only.

  • spagnod@lemmy.worldEnglish
    0·
    1 year ago

    Just do it properly and configure sshd securely. When you have a machine exposed to the internet, you should expect it to be attacked. If you really want to give the finger to bots, run endlessh on port 22 and keep sshd on a non-standard port. Stay safe.