I made my ssh server to listen ipv6-only, and it has been super silent in the logs ever since.

In the first iteration the IPv6 got polled by a handful of attackers as soon as the letsencrypt certificate was published. In the second iteration I just picked another IPv6 address from the /64 and made ssh.example.com to point to it. This should work until the attackers start guessing subdomain s...

▲

imoverclocked 16 hours ago | parent [-]

This is an interesting piece that is often overlooked by folks in the "but NAT is security" camp; Having a sparse address space that is 64-bits makes it impossible to iteratively scan over a range. If you don't reverse resolve or you disallow zone transfers then you also have no real discoverability for that /64.

	▲	happosai 8 hours ago \| parent [-]
		Nobody allows zone transfers these days. But there is still the option for doing a dictionary attack on subdomains admin/ssh/console.example.com But yeah scanning IPv6 address space directly without DNS dictionary in hand is tough.