Hacker News Reader

Comment by gxt | Hacker News Reader

This sounds like another reason to no longer put SSH on the bare internet and layer security by only exposing wireguard and having sshd listen on the wireguard network.

This is not helpful for currently vulnerable setups but hopefully will be a good reminder to think about defense in depth :)

View on HN

Honest question: why would Wireguard be any safer?

It's a much more recent design that avoids this particular pitfall. This is mentioned in the tptacek's comment https://news.ycombinator.com/item?id=38684904

And is there any guarantee that 20 years later a similar weakness of WireGuard will not be found?

It isolate the network? From my understanding the setup entails deploying sshd behind wireguard, thus only authenticated users can ssh.

Way fewer ciphers in the protocol, it basically has only one set of algorithms so there's way less negotiation.

You can restrict most of these options both client- and server-side in SSH, which is basically always a winning move, regardless of protocol. You can't be downgraded to a protocol version or cipher that you've explicitly disabled.

You can't select which ones get attention from the maintainers however.

If sshd is behind wireguard, it's defense in depth.

The probability of an attacker targeting you having an exploit for both at the same time will be lower that having an exploit for either.

On the other hand, if the WireGuard implementation has a vulnerability, the attacker does not need to attack SSH at all and simply punch through WireGuard to have kernel-level access to the system.

It's not defense-in-depth; it's a security chain : only as strong as its weakest link.

Reply on news.ycombinator.com