Alert - Yesterday's SSH Login Failures

[garm]

Sorry - I'm a bit tired of the stereotyped response, "stop exposing your NAS to the internet".

That's your natural right, but you're wrong..

Why relying on network perimeter security alone is a failure | TechTarget

Network perimeter security is failing enterprises. Paul Henry explains why enterprises need to evolve beyond perimeter defense.

www.techtarget.com

You do not have the skills to protect yourself... The only thing you can do is to not expose yourself

 

[Patrick M. Hausen]

@garm But not exposing to the public Internet is perimeter defense.

 

[garm]

@Patrick M. Hausen yes yes, but James wants to accept incoming requests, there is a world of difference in breaching an invisible wall and one that talks back at you. Yes you still need layers, but zero trust and authentication scales way up as soon as you have a service talking back to the zombies on the other side of the wall.

 

[James S]

I totally get this sentiment and I do think it's overblown sometimes. In my opinion, there's nothing wrong with exposing SSH so long as you've taken the proper precautions

Great thanks - that is a bit of reassurance that I needed from someone deeper into this space than me

My recommendation for VPN is really more from the standpoint of convenience vs security.

Again, thanks - this sounds like a pragmatic path (in other words more accessible than digging into SOCKS)

yes yes, but James wants to accept incoming requests, there is a world of difference in breaching an invisible wall and one that talks back at you. Yes you still need layers, but zero trust and authentication scales way up as soon as you have a service talking back to the zombies on the other side of the wall.

What a great comment . . . It is the scaling that is the issue (he said, peering down into the void of PFSense firewalls, VPNs, SOCKS - and, from the sound of things that is just the starting point )

 

[NameAgain]

Actually, it is true that not exposing your NAS is safer. But I think first I would ask, do you need to do it? E.g. do you want to host a website etc.? In that case, I don't see any possibility to not expose your NAS. But you could create a second internal IP where your services are running behind Traefik. This will not stop attacks, but reduce them. @All which additional safety measures would you implement if you want to host services which should be accessible from outside?

I really liked this video: https://www.youtube.com/watch?v=QSMgfz5zrxo