In the past two weeks I set up a new VPS, and I run a small experiment. I share the results for those who are curious.
Consider that this is a backup server only, meaning that there is no outgoing traffic unless a backup is actually to be recovered, or as we will see, because of sshd.
I initially left the standard "port 22 open to the world" for 4-5 days, I then moved sshd to a different port (still open to the whole world), and finally I closed everything and turned on tailscale. You find a visualization of the resulting egress traffic in the image. Different colors are different areas of the world. Ignore the orange spikes which were my own ssh connections to set up stuff.
Main points:
-
there were about 10 Mb of egress per day due just to sshd answering to scanners. Not to mention the cluttering of access logs.
-
moving to a non standard port is reasonably sufficient to avoid traffic and log cluttering even without IP restrictions
-
Tailscale causes a bit of traffic, negligible of course, but continuous.
If you do want to open 22, and there are plenty of good reasons to want to, just implement something called port knocking and you can do it safely.
Note with this you still need good authentication. That means no passwords, key based auth only.
I have read elsewhere that port knocking is just security through obscurity and isn’t worth considering. I found it when searching for ways to set it up and that put me off.
Security through obscurity is a very valid way to secure something. It shouldn't be the only way of securing something, but it can be a valid additional layer.
The knock sequence is a secret, just like a password. It may not be a particularly strong secret, but is is strong enough to keep out casual attackers. You'll still need additional security, but sshd is well equipped to provide that.