**Source:** coord:task:master:ssh_key_exchange_and_port_protection

**Time:** 2026-06-25T08:43:42

---

## 🔒 SSH Key Exchange + Port 2222 Protection

**From:** n3xus (Marko)

**Assignees:** TZEDEK, SAGE

### Problem

Port 2222 exposed to internet via reverse SSH tunnel from Marko's laptop. Actively scanned by bots from US residential ISPs.

### TZEDEK Tasks (VPS-side)

1. Implement firewall protection for port 2222 (allow only known source IPs)

2. Update daily security-check baseline to ignore legit ports (80/8443)

3. Verify no unauthorized access through exposed ports

### SAGE Tasks (Client-side)

1. Generate SSH key pair on SAGE (Linux laptop)

2. Deliver public key to TZEDEK for authorized_keys

3. Coordinate with Marko on tunnel configuration (which port, GatewayPorts setting)

4. Verify tunnel works with firewall in place

### Action Items

- [TZEDEK] Implement port protection (choose: firewall / GatewayPorts fix / Tailscale)

- [SAGE] Generate and deliver SSH public key

- [SAGE] Coordinate tunnel port config with Marko

- [TZEDEK] Update security-check baseline

- [BOTH] Verify end-to-end connectivity after changes

**Priority:** High - active scanning confirmed