> Then again, if you have a large group of servers, you should have those ports blocked to the world and only allow access through a VPN and/or jump boxes.
Even with just one server it can make sense to use a VPN.
In my case I am running Wireguard on my server, and I use that VPN among other things for being able to remote in to my grandfather’s computer when he needs help. Since we are both behind NAT at our respective homes, a VPN was needed and I chose to use Wireguard. Wireguard is super easy to set up, and works on FreeBSD (my server and also my desktop run this), macOS (my laptop and my grandfather’s desktop run this), iOS (my phone) and Linux (currently I don’t run Linux but I have for many years and will certainly run it again on some machines again). I don’t use Windows, almost haven’t for a decade with a few small exceptions, but I think Wireguard is available for Windows also.
So anyway, I decided back when I set up Wireguard hey, now that all my machines and my phone is on this VPN, there’s really no reason to expose SSH to the internet anymore. So ever since then I have had sshd listen only on the VPN. It works great.
This. For any amateur server setup that is connected to Internet, wireguard is one-stop solution to cut down all exposure to Internet by running all services only on localhost or wireguard interface and keep only the wireguard port open to Internet.
Even with just one server it can make sense to use a VPN.
In my case I am running Wireguard on my server, and I use that VPN among other things for being able to remote in to my grandfather’s computer when he needs help. Since we are both behind NAT at our respective homes, a VPN was needed and I chose to use Wireguard. Wireguard is super easy to set up, and works on FreeBSD (my server and also my desktop run this), macOS (my laptop and my grandfather’s desktop run this), iOS (my phone) and Linux (currently I don’t run Linux but I have for many years and will certainly run it again on some machines again). I don’t use Windows, almost haven’t for a decade with a few small exceptions, but I think Wireguard is available for Windows also.
So anyway, I decided back when I set up Wireguard hey, now that all my machines and my phone is on this VPN, there’s really no reason to expose SSH to the internet anymore. So ever since then I have had sshd listen only on the VPN. It works great.