Step 1) Setup OpenVPN. Step 2) Block ssh access using iptables or equivalent from all but the VPN connections and one or two trusted IPs (the latter just in case you need to do OpenVPN maintenance). Back in the day, you would have had a separate network for administration. Simulate that with OpenVPN.
It's depressing that your post hasn't received more attention. Your control systems should be on a private control network, not exposed to the wide internet.
OpenVPN is capable of providing a much, much smaller attack surface than OpenSSH (see http://news.ycombinator.com/item?id=1665773), and can be run entirely chroot'd and setuid such that even if an attacker does compromise OpenVPN, they can not necessarily gain further access.
There seems to be a prevailing lack of understanding that bad passwords are not the only concern when using SSH. The daemon itself may be vulnerable to exploit (and in the past, it has been).
Comments
Step 1) Setup OpenVPN. Step 2) Block ssh access using iptables or equivalent from all but the VPN connections and one or two trusted IPs (the latter just in case you need to do OpenVPN maintenance). Back in the day, you would have had a separate network for administration. Simulate that with OpenVPN.
It's depressing that your post hasn't received more attention. Your control systems should be on a private control network, not exposed to the wide internet.
OpenVPN is capable of providing a much, much smaller attack surface than OpenSSH (see http://news.ycombinator.com/item?id=1665773), and can be run entirely chroot'd and setuid such that even if an attacker does compromise OpenVPN, they can not necessarily gain further access.
There seems to be a prevailing lack of understanding that bad passwords are not the only concern when using SSH. The daemon itself may be vulnerable to exploit (and in the past, it has been).