The real solution is using something like Pangolin or Tailscale (or Headscale) for this. You can control access way better and you never have to expose ssh ever. Not even temporarily.

▲

hn_throw2025 12 hours ago | parent [-]

I agree with you.

I’m reading this thread and wondering if I’m missing something, why people are still talking about port knocking, port obfuscation, and fail2ban.

I use a cloud VPS. I ssh in via Tailscale. The cloud provider firewall blocks all incoming connections except traffic originating from Cloudflare IP ranges on port 443. My host plays dead to portscans. I check with nmap periodically. I have a break-glass backup terminal login option via my cloud provider dashboard (secured with MFA) in case Tailscale failed and needed investigation and repair.

This has worked well for me on AWS and Oracle Cloud. It’s quick and easy to set up. You need a timed service to refresh the ingress IP ranges, but any LLM could spit that out in a second.

▲

figmert 4 hours ago | parent | next [-]

> I check with nmap periodically. I have a break-glass backup terminal login option via my cloud provider dashboard (secured with MFA) in case Tailscale failed and needed investigation and repair.

Cool! Are you able to provide more information on this? My break glass is to temporarily allow public access to my IP, but it's manual and takes time for the firewall rules to apply. I'd love to have a better solution if possible.

▲

fragmede 10 hours ago | parent | prev [-]

For those machines, yeah, but I have this fear, of being somewhere and my digital connection is broken. My phone/laptop/everything is stolen/lost/destroyed, and I have to break back in to my digital life. 2 factor authentication screws you if you don't have the second factor because you got mugged. So there might be a server out there that I can ssh into using a username, password, and a memorized IP address, that will get me recovery codes and into my password manager.

	▲	hn_throw2025 8 hours ago \| parent [-]
		By MFA I meant the Yubikey plugged in to my home office Mac; I don’t do sysadmin on the bus. But I take your point… I try to make sure I print out recovery codes when offered, and keep them hidden in a safe place at home.