Is it safe to expose SSH to the internet?

It is common, but it is a standing target: internet-facing SSH servers receive automated login attempts constantly. If you must expose it, allow key-based logins only, disable password and root logins, keep OpenSSH patched and restrict the source addresses where you can; a VPN or a bastion host in front of it is better still. A different port reduces log noise but is not protection. Keep a list of every SSH server you expose and review it, because forgotten test servers are the ones that stay unpatched. NetSenX sees connections to monitored hosts and flags scanning, repeated login attempts and unusual sessions involving them, on every plan. From the Pro plan, with packet capture on a Linux agent or a SPANSPAN: switch port analyser. A switch setting that sends a copy of network traffic to one port, where a sensor can watch it. or TAPTAP: test access point. A small device that copies the traffic on a network cable for a sensor to watch. sensor, its cryptographic inventory also lists the SSH versions that servers announce.

← All 40 questions on Remote work and exposed servicesAll topics