Self-Hosted Main

In a word no. That’s not a port you want others sniffing around. Some isps actively block that port for security. IMHO a vpn is the best way. That way you get full access to your network as if you’re using a wired direct connection. You “can” use port 22 and you can make it pretty secure but I just wouldn’t feel safe directly exposing it when there are other ways. Imagine the access somebody could get if you do something slightly wrong or you miss a patch for a new vulnerability. Yep it’s unlikely but why risk it. Put it behind something on a none standard port rather than a port that every sniffer will poke at :)

In my case, password auth disabled, changed port, fail2ban, and not exposing the port, I connect through vpn and then ssh, but in the end it's still an open port for the vpn

Rather than port forward 22, I would recommend using the ipv6 address and securing the host.

Set up free Tailscale and access your server that way.

Yes, it's perfectly safe. Keep it patched, use strong ciphers, use key authentication, and set up an IDS like Fail2Ban or CrowdSec.

A tremendous amount of cargo culting going on here.

As long as your server is aggressively kept up to date and doesn't have any guessable passwords, exposing port 22 can be done safely. If you're not certain about these, you shouldn't. OpenSSH is exposed to the open internet on millions of servers, it's meant to do this.

Fail2ban or changing your ssh port provides no additional security and only serves to reduce log noise at the risk of blocking actual users.

A VPN makes no practical difference. ssh uses strong encryption just like the VPN. Sure you're hiding ssh, but the VPN provides a similar attack surface.

I wouldn't open up 22 to the world. I would change the port at a minimum or use a VPN.

Using an alternate port will drastically cut down on the number of people trying to brute force your server

Depending on how you will be connecting depends on how you should configure this. I would strongly suggest just setting up a Wireguard server and connect to it via VPN. At the same time, exposing the port and using a pubkey with Fail2Ban would be the next best option, while always keeping your server patched with port forwarding a different port to the stand SSH port internally.

These are the simplest ways to do this and still be secure. Again, I strongly suggest setting up a private VPN of your choosing.

WireGuard Installs - https://www.wireguard.com/install/

WireGuard Docker - https://github.com/wg-easy/wg-easy

I know that some VPN are able to create private networks for devices logged with your account. For exemple nordvpn is able to connect your devices into their "mesh network" and make your devices available through the VPN. I think it's better than exposing a ssh service on Internet, even with a lot of protections!

Port forwarding opens an attack surface- whatever service you're exposing is the "attack surface" so make sure it's secure.

disabling password login

This is absolutely a very strong/good hardening first-step.

pubkey authentication

Hell yeah. Very strong. Just keep that key safe (don't post it on the Internet, put it somewhere insecure or public, etc. Also recommended to password protect the key for extra safety.

Additional steps you could take if you were worried: two-factor authentication, usually easy to setup and effective. Fail2ban or other IP blockers, takes more work and setup. Rate-limiting is a basic feature most ssh services have (e.g. more than 3 failed attempts = 5 minute lockout).

But honestly keys-only, IMHO, is the safest 👍

First of all don't expose a machine on your LAN unless it is very well locked down especially with respect to ability to access rest of LAN. To simply access home LAN set up home VPN that has the access instead of opening up a port as powerful as ssh. If you open ssh then put it at some other port than the well known 22 and make it accessible by authorized key only. I would further limit where this ssh can be accessed from using firewall rules.

Should be safe enough to do this but I’ll throw in one potential caveat. Say that you one day somehow need to troubleshoot your ssh server and have to re-enable password authentication. Depending on how many other services you plan to run, it can be easy to suddenly forget you have port 22 exposed on the outside and someone could potentially break in if you use a weak password. This is why I personally host only necessary https content over port 443 to the world. I host anything else so only my wireguard vpn can access it. As for bots hitting port 22 on the outside can be another huge problem. Changing the port can disuade some but remember that the port number is only two bytes in size. A comprehensive port scan only takes a very short amount of time to complete. This, in my humble opinion, creates an extra point of access for you to remember for not that much to gain. That all being said, forwarding key protected ssh is safe enough to do.

no