I closed SSH port 22 entirely — here's what I use instead
I close SSH port 22 (and what I use instead)
Most SSH hardening guides stop at key-only auth and fail2ban, but port 22 remains exposed to scanners and zero-days. The author uses fwknop's Single Packet Authorization (SPA) to make the SSH daemon completely unreachable unless a valid encrypted UDP packet is received. This article explains how SPA works, how to generate keys, deploy the server with Ansible, configure clients, and integrate it with SSH and Ansible. It also covers Tailscale as a parallel access path, and what this setup actually changes in terms of attack surface and log noise.
This is not security through obscurity. The port is not hidden behind some clever port number. It is genuinely closed.
- usernametaken29
I don’t know why this wasn’t mentioned before but why not use a Firewall. If you’re using a virtual box like Hetzner or Scaleway you can specify an ip or range at the router level. For all intents and purposes this removes public exposure. Scaleway also has a cheap VPN bridge. So you never need to connect via the public internet if you don’t want to… hardly gets more secure than that
- kazinator
[delayed]
- happosai
I made my ssh server to listen ipv6-only, and it has been super silent in the logs ever since.
In the first iteration the IPv6 got polled by a handful of attackers as soon as the letsencrypt certificate was published. In the second iteration I just picked another IPv6 address from the /64 and made ssh.example.com to point to it. This should work until the attackers start guessing subdomain s...