[mkup]

My idea of getting one step ahead of similar backdoors is to wrap sshd traffic into a spiped tunnel. Spiped is compiled from source and linked statically (last stable version from 2021).

[markhahn]

jeez, why not just compile ssh static?

[mkup]

I still want sshd updated by my OS package manager. Statically linked spiped, which is out of scope of my OS package manager, is just a second line of defense.

[cpach]

spiped is solid. Wireguard is another good option that is included in the Linux kernel.