Every server exposed to the internet is a target. The moment you open port 22 to accept SSH connections, you’ve published an address the entire world can probe — and it does, relentlessly. Bots scan the IPv4 space continuously, hammering exposed SSH daemons with credential-stuffing attempts around the clock.
The standard mitigations — IP allowlists, fail2ban, bastion hosts, VPNs — all reduce the blast radius, but they share one assumption: that the host must listen for inbound connections. Subnomic takes a different stance. What if the host never listened at all?
The inbound problem
A listening port is a standing invitation. Even with key-only authentication, an exposed SSH service leaks information, spends resources fielding junk traffic, and is a single CVE away from compromise. Bastion hosts concentrate the risk into one box, but that box still listens — and once an attacker is through it, the whole fleet is reachable.
If nothing listens, there is nothing to attack from the outside.
Outbound-only by design
The Subnomic agent runs on each host and opens one long-lived outbound connection to Subnomic, encrypted with TLS and authenticated with the agent’s own token. No inbound firewall rule is required. Port 22 — and every other management port — can stay closed to the internet. The connection starts from inside your network, the same way a laptop reaches a website.
When someone opens a terminal, the request travels back down the connection the agent already holds. The host never accepts a fresh inbound connection. The agent also refuses to dial anything outside its allowlist, which defaults to loopback and private addresses.
# Traditional: the host listens, the world knocks
client ──▶ :22 (open to the internet) ──▶ sshd
# Subnomic: the host dials out, nothing listens
agent ──▶ Subnomic (outbound TLS) ◀── you, in a browser or the CLIWhat this buys you
- No port to find — there is nothing listening to scan, fingerprint or brute-force.
- No bastion to harden — the connection is brokered, not a box you have to patch and babysit.
- Works behind NAT — because the agent dials out, hosts on private networks need no inbound routing.
- A person on every session — every terminal is opened by someone who signed in, and it is recorded from the first byte.
Is it still SSH?
Not on the wire — and that is the point. There is no sshd for anyone to reach and no private key to copy onto another laptop. What you get is a full interactive terminal on the host, a real PTY so htop and vim behave, opened from the browser or from your own terminal:
$ subnomic ssh db-primaryOn Linux you act as your own operator user rather than a shared account, each command line passes the workspace’s guardrails, and the session is recorded for replay.
Closing the last port
The network perimeter stopped being a useful boundary a long time ago. Closing port 22 entirely, and putting a signed-in person and a recording behind every terminal, removes a whole category of attacks before they can begin.
Want it on your own servers? See Fleet — servers start on Pro.