Stop exposing RDP and SSH to the internet
Bots try your remote desktop and SSH ports all day. Put them behind a VPN and use keys.
Put a server online with remote desktop or SSH open to the world and the login attempts start within minutes. All day, every day, from bots trying leaked passwords.
Exposed RDP is still one of the most common ways ransomware gets in. Here’s what I do instead:
- Close the ports to the internet. Reach servers through a VPN (WireGuard is quick to set up) or a zero-trust access service.
- If SSH must stay open, allow keys only (
PasswordAuthentication no), no root login, and limit it to known IPs if you can. - Turn on MFA for the VPN and remote desktop gateway.
- Add rate limiting such as fail2ban, so one IP can’t try forever.
- Check from the outside. Scan your own public IPs once a month. You’ll be surprised what someone opened “for a quick test”.
Moving a port number from 22 to 2222 isn’t security. It just makes the log shorter.