zlacker

>>todsac+(OP)
Every server gets constantly probed for SSH. Since half the servers on the Internet haven't been taken over yet, it doesn't seem like SSH has significant exploits (well, there was that one signal handler race condition).

Unless you're trying to do one of those designs that cloud vendors push to fully protect every single traffic flow, most people have some kind of very secure entry point into their private network and that's sufficient to stop any random internet attacks (doesn't stop trojans, phishing, etc). You have something like OpenSSH or Wireguard and then it doesn't matter how insecure the stuff behind that is, because the attacker can't get past it.

>>immibi+U4
It's also common practice to do what everyone here recommends and out things behind a firewall.

The seperation of control and function has been a security practice for a long time.

Port 80 and 443 can be open to the internet, and in 2024 whatever port wireguard uses. All other ports should only be accessible from the local network.

With VPS providers this isn't always easy to do. My preferred VPS provider. However provides a separate firewall which makes that easier.