Should I use a second/dedicated IP address for SSH?

Unless that IP address belongs to a dedicated management network which implements additional security, it is a waste of resources.

Both IPs are, obviously, ending up on the same server. This means that, unless they come in through different networks (i.e. a management network that implements additional protection), there will be no difference locally between a connection to SSH going on one IP or the other: you can firewall these exactly in the same way (if you want) and it doesn't make any more or less obvious in the logs.

The only thing you're "hiding" is the relation between the SSH server and the web server and, unless you have very poor procedure for picking up account names, then it shouldn't matter.

If you're using a dedicated management network, however, it's a different matter: such a network could require all connections to go though a secure authentication phase and impose extra limitation on the conneting party (for instance, you can require them to be physically connected to the network, or go through a VPN requiring 2FA and making sure your client is "clean").


You are basically correct. It is obfuscation. Obfuscation is not without value, but you should not rely on it.

The first answer is correct, BTW, that it is good practice to host management services such as SSH on a separate network (i.e., not the internet).


It is a bit like moving SSH to a different port. You just hide something (poorly) and that shouldn't be something to rely the security of a system on. It might throw off the attackers that really don't know what they are doing (and they will not get into ssh anyway if it is setup properly) but is useless otherwise.