Ask HN: Is Connecting via SSH Risky?

#1

Post by atrevbot » Thu, Feb 05, 2026, 3:56 AM UTC

I have been managing websites for a while and usually utilize SSH connections to login to, deploy code to, and otherwise remotely access the hosting servers.

I was recently informed that a client I work with considers that a legal risk.

If the SSH connection is set to disallow passwords and only authorize via SSH keys, how big of a risk is this?

Re: Ask HN: Is Connecting via SSH Risky?

#2

Post by phren0logy » Thu, Feb 05, 2026, 4:05 AM UTC

Compared to what?

Re: Ask HN: Is Connecting via SSH Risky?

#3

Post by DamonHD » Thu, Feb 05, 2026, 4:08 AM UTC

phren0logy wrote: post #2

Compared to what?

Indeed.

Re: Ask HN: Is Connecting via SSH Risky?

#4

Post by atrevbot » Thu, Feb 05, 2026, 4:12 AM UTC

phren0logy wrote: post #2

Compared to what?

They seem to be okay w/ only HTTP ports being open on the server (80, 443). They "found that open ports can lead to cyber claims".

Re: Ask HN: Is Connecting via SSH Risky?

#5

Post by robertcope » Thu, Feb 05, 2026, 4:57 AM UTC

How else would you do it?

Re: Ask HN: Is Connecting via SSH Risky?

#6

Post by rl3 » Thu, Feb 05, 2026, 5:08 AM UTC

Best practices usually call for not exposing the SSH endpoints to the public internet. The principal risk is vulnerabilities in the underlying SSH server implementation. Historically, critical flaws that can compromise you are few and far between. However, these days AI is already starting to become adept at reverse engineering.

If you must, you'd typically use a bastion host that's configured just for the purpose of handing inbound SSH connections, and is locked down to a maximal degree. It then routes SSH traffic to your other machines internally.

I'd argue that model is outdated though, and the prevailing preference is putting SSH behind the firewall on internal networks. Think Wireguard, Tailscale, service meshes, and so on.

With AWS, restricting SSH ports via security groups to just your IP is simple and goes a long way.

Re: Ask HN: Is Connecting via SSH Risky?

#7

Post by verdverm » Thu, Feb 05, 2026, 5:12 AM UTC

Runs counter to my understanding, I'd ask for clarification and find support material to show your approach is safer.

Treat it as a teaching moment for them

Re: Ask HN: Is Connecting via SSH Risky?

#8

Post by speleolinux » Thu, Feb 05, 2026, 5:12 AM UTC

If your private key has a good passphrase and is suitably encrypted, say with ed25519, then that's probably as good as you can do other than physically going into work and storing everything in your head :-) Politely ask the client to suggest what they consider would be a suitable alternative. I also setup git hooks to prevent accidentally checking in private keys or passwords into git or other version control systems. And if I'm travelling into or from work I also encrypt some stuff just in case I have a problem and the laptop is stolen.

Re: Ask HN: Is Connecting via SSH Risky?

#9

Post by bediger4000 » Thu, Feb 05, 2026, 5:14 AM UTC

atrevbot wrote: post #4

phren0logy wrote: post #2

Compared to what?

They seem to be okay w/ only HTTP ports being open on the server (80, 443). They "found that open ports can lead to cyber claims".

That's like saying that open bottles lead to alcoholism.

Re: Ask HN: Is Connecting via SSH Risky?

#10

Post by tim-tday » Thu, Feb 05, 2026, 5:30 AM UTC

They probably mean leaving ssh open to all ips. Take a look at your auth failure logs to see the thousands of daily attempts to compromise your server using default passwords. Most of those are low effort and low risk. Sometimes the bots will try password stuffing. Disabling password auth in sshd config is good practice. Fail2ban also helps block repeated attempts like that.

There’s also the risk of a zero day RCE vulnerability in ssh (though I’ve not seen one in the 20 years I’ve been paying attention )

I tend to not expose ssh to the world and log in with some other method to pass the perimeter (VPN, IP whitelist, tailscale) and the ssh from inside.