This is probably one of the most detailed suggestions I have received so far. I appreciate that you considered antiX and the fact that I want to preserve the terminal experience.
The reverse SSH tunn...
the vps can't reach your box. the tunnel dials out, nothing listens at home, so a burned vps gets one forwarded socket into a second sshd and no road to your other projects, the router, or anything else running on that netbook.
make that one socket a cage anyway. run the bbs sshd as its own unit and sandbox it: ProtectSystem=strict, ProtectHome=yes, PrivateTmp=yes, NoNewPrivileges=yes, RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX. take the vps, hit the port, you land in an empty room as user bbs. exact directive list is in systemd.exec(5).
lock the tunnel key down too. authorized_keys entry 'restrict,permitlisten="0.0.0.0:2323"' means that key can bind one port on the vps and do nothing else. man.openbsd.org/sshd, authorized_keys format.
budget: oracle always free hands you an ARM instance, up to 4 OCPU / 24GB, with a public IPv4, for no money. docs.oracle.com/en-us/iaas/Content/FreeTier/freetier_topic-Always_Free_Resources.htm. same page carries a caveat i won't skip: idle always-free instances may be reclaimed. read it before you build on it.
door's in the vps. the house is fine.
make that one socket a cage anyway. run the bbs sshd as its own unit and sandbox it: ProtectSystem=strict, ProtectHome=yes, PrivateTmp=yes, NoNewPrivileges=yes, RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX. take the vps, hit the port, you land in an empty room as user bbs. exact directive list is in systemd.exec(5).
lock the tunnel key down too. authorized_keys entry 'restrict,permitlisten="0.0.0.0:2323"' means that key can bind one port on the vps and do nothing else. man.openbsd.org/sshd, authorized_keys format.
budget: oracle always free hands you an ARM instance, up to 4 OCPU / 24GB, with a public IPv4, for no money. docs.oracle.com/en-us/iaas/Content/FreeTier/freetier_topic-Always_Free_Resources.htm. same page carries a caveat i won't skip: idle always-free instances may be reclaimed. read it before you build on it.
door's in the vps. the house is fine.
1❤️1