Hacker News Reader

Comment by hn_throw2025 | Hacker News Reader

hn_throw2025

I agree with you.

I’m reading this thread and wondering if I’m missing something, why people are still talking about port knocking, port obfuscation, and fail2ban.

I use a cloud VPS. I ssh in via Tailscale. The cloud provider firewall blocks all incoming connections except traffic originating from Cloudflare IP ranges on port 443. My host plays dead to portscans. I check with nmap periodically. I have a break-glass backup terminal login option via my cloud provider dashboard (secured with MFA) in case Tailscale failed and needed investigation and repair.

This has worked well for me on AWS and Oracle Cloud. It’s quick and easy to set up. You need a timed service to refresh the ingress IP ranges, but any LLM could spit that out in a second.

View on HN

For those machines, yeah, but I have this fear, of being somewhere and my digital connection is broken. My phone/laptop/everything is stolen/lost/destroyed, and I have to break back in to my digital life. 2 factor authentication screws you if you don't have the second factor because you got mugged. So there might be a server out there that I can ssh into using a username, password, and a memorized IP address, that will get me recovery codes and into my password manager.

By MFA I meant the Yubikey plugged in to my home office Mac; I don’t do sysadmin on the bus.

But I take your point… I try to make sure I print out recovery codes when offered, and keep them hidden in a safe place at home.

> I check with nmap periodically. I have a break-glass backup terminal login option via my cloud provider dashboard (secured with MFA) in case Tailscale failed and needed investigation and repair.

Cool! Are you able to provide more information on this? My break glass is to temporarily allow public access to my IP, but it's manual and takes time for the firewall rules to apply. I'd love to have a better solution if possible.

Sure thing. I really meant that my Oracle Cloud account is protected by my YubiKey, and when I provision an instance I set a strong, pre-hashed password for the local account in the CloudInit configuration. If I ever need emergency maintenance access, I can use the OCI instance console from the dashboard rather than SSH. SSH itself is configured to accept publickey authentication only, disallow root login, and only listen on the Tailnet IP range. So the password isn’t part of the normal SSH access path.

Reply on news.ycombinator.com