@toiletpaper @CSB
> Either way you're exposing a port on your server and requiring (presumably) a cryptographic key based authentication scheme.

Yes, you always have to expose something, there are no free cookies.

SSH gives you tunneling or terminal. VPN gives you network access. They are different layers of whatever you want to achieve.

> If you think doing that is going to prevent the need for hardening the service, you're frankly fooling yourself

This is an stupid reasoning, because your proposal let your servers open for attacks, from random IPs or VPNs, not even sshguard may fully help here.

It's lot better to have a two authentication systems instead of just one, one to "allow access to servers", then another to "ssh the servers".

So, in case a coworker gets their SSH keys exposed at internet because he is rtarded, the hackers will also need VPN access, which is harder to get accepted.