Comment

Comment on Notes on full disk encryption on a Hetzner cloud VPS

Set up a firewall and only open port 22 with your IP (you can look it up using ip.me).

I keep wondering about this part whenever I read it. Do y’all have static IP addresses so you can do this easily? If I did this, I’d probably lock myself out within a week (which is roughly the interval at which my public IPv4 will change).

source

Sort:hotnew top

offspec@lemmy.world ⁨9⁩ ⁨hours⁩ ago
This post is about a hetzner host so I would assume it’s static

source
versionc@lemmy.world ⁨9⁩ ⁨hours⁩ ago
This is only supposed to be temporary while you set up the FDE, your IP is unlikely to change in the 30 minutes or so it takes to go through these steps.

In any other scenario I’d close port 22 and use a mesh VPN with SSH capabilities, like Netbird or Tailscale. I’d only open it up again to access Dropbear during reboots, and I’d use IP filtering for that as well.

As for DHCP, I guess it depends on the ISP. I don’t have a static IP but mine doesn’t change as far as I can tell unless my router is disconnected for a longer while.

source
- IratePirate@feddit.org ⁨9⁩ ⁨hours⁩ ago
  Now I get it. Thanks for the explanation!
  
  source
ShortN0te@lemmy.ml ⁨10⁩ ⁨hours⁩ ago
use ddns or similar to keep track of tour IP?

source
- IratePirate@feddit.org ⁨9⁩ ⁨hours⁩ ago
  Sure, that’s what I do for hosting my stuff. DDNS does not help with SSH whitelisting because that is IP-based, not based on a URL.
  
  source
  - ShortN0te@lemmy.ml ⁨8⁩ ⁨hours⁩ ago
    Stupid me, missed the IP whitelisting part.
    
    source