[harborsong]

Highly recommend blocking the ssh port on all public facing instances and machines. Remember the recent xz/ssh backdoor exploit that was discovered.

What if there is another backdoor lurking undiscovered?

Do what I did, only open ssh over a VPN, or at least restrict it to a specific inbound IP or CIDR block under your direct control.

[clinta]

What if there's another backdoor lurking in your VPN software? Why are you more confident in your VPN than SSH? Of those two pieces of software, which do you think has more eyes on it?