In the past two weeks I set up a new VPS, and I run a small experiment. I share the results for those who are curious.

Consider that this is a backup server only, meaning that there is no outgoing traffic unless a backup is actually to be recovered, or as we will see, because of sshd.

I initially left the standard “port 22 open to the world” for 4-5 days, I then moved sshd to a different port (still open to the whole world), and finally I closed everything and turned on tailscale. You find a visualization of the resulting egress traffic in the image. Different colors are different areas of the world. Ignore the orange spikes which were my own ssh connections to set up stuff.

Main points:

  • there were about 10 Mb of egress per day due just to sshd answering to scanners. Not to mention the cluttering of access logs.

  • moving to a non standard port is reasonably sufficient to avoid traffic and log cluttering even without IP restrictions

  • Tailscale causes a bit of traffic, negligible of course, but continuous.

  • ShortN0te@lemmy.ml
    link
    fedilink
    English
    arrow-up
    7
    ·
    1 year ago

    And yet it is more likely that tailscale get owned since the reward is much higher. I take my chances with my secured openssh server at port 22 vs a 3rd party company who controlls the access.

        • Rearsays@lemmy.ml
          link
          fedilink
          English
          arrow-up
          2
          ·
          1 year ago

          Wireguard doesn’t respond but I agree open-ssh is pretty solid. Can’t speak for any of the other ssh implementations. It can also be poorly configured. Like you could use a password

          • droans@lemmy.world
            link
            fedilink
            English
            arrow-up
            1
            arrow-down
            1
            ·
            1 year ago

            The benefit of Wireguard is that if you screw it up, it just won’t work. It basically enforces security.

            Well, unless you tried to use the original PFSense module.