# Is it safe to expose SSH to the internet?

It is common, but it is a standing target: internet-facing SSH servers receive automated login attempts constantly. If you must expose it, allow key-based logins only, disable password and root logins, keep OpenSSH patched and restrict the source addresses where you can; a VPN or a bastion host in front of it is better still. A different port reduces log noise but is not protection. Keep a list of every SSH server you expose and review it, because forgotten test servers are the ones that stay unpatched. NetSenX sees connections to monitored hosts and flags scanning, repeated login attempts and unusual sessions involving them, on every plan. From the Pro plan, with packet capture on a Linux agent or a SPAN or TAP sensor, its cryptographic inventory also lists the SSH versions that servers announce.

FAQ: [Remote work and exposed services](https://netsenx.com/en/faq/remote) · https://netsenx.com/en/faq/is-it-safe-to-expose-ssh-to-the-internet

## Read next

- https://netsenx.com/en/is-someone-inside-your-network
- https://netsenx.com/en/blog/2026-11-06_sshole-cve-2026-123158

## Related questions

- [Which services should never be exposed to the internet?](https://netsenx.com/en/faq/which-services-should-never-be-exposed-to-the-internet)
- [How does remote working increase cyber-security risk?](https://netsenx.com/en/faq/how-does-remote-work-increase-cyber-risk)
- [How do I secure remote workers who access the company network?](https://netsenx.com/en/faq/how-to-secure-remote-workers-accessing-the-company-network)
- [Do we need a VPN for remote work?](https://netsenx.com/en/faq/do-we-need-a-vpn-for-remote-work)
- [Is a VPN protected only by a password enough?](https://netsenx.com/en/faq/is-a-vpn-without-multi-factor-authentication-enough)