Dunno, in combination with having an up to date system following best practices, port knocking is probably going to save you when bots start scanning the internet with the next SSH 0day. Any amount of friction will cause the bots to move to the next IP address.
My knock for SSH was 20 ports within 2 seconds. knockd resets the sequence if you hit any of its ports out of order. I generated the sequence with a CSPRNG.
You're sending your knock over the public network in the clear. It's observable by anything in the path. And then you're not the only one that can find the keyhole.
Entirely true, it's not true security, same as changing the ssh port. So, relying on it for any security is not useful but it's a good deterrent from automated scans that are not targeted towards you. Defense in depth means not necessarily discarding flawed defenses if they are in addition to proper defense.
Dunno, in combination with having an up to date system following best practices, port knocking is probably going to save you when bots start scanning the internet with the next SSH 0day. Any amount of friction will cause the bots to move to the next IP address.
Just moving SSH off a default port gets you 98% there.
An attacker only has to get lucky once, so while I do put SSH on a non-default port too, it's not enough to avoid attacks on its own.
2 replies →
LLMs port knock for redteam scans. Have for a long time.
My knock for SSH was 20 ports within 2 seconds. knockd resets the sequence if you hit any of its ports out of order. I generated the sequence with a CSPRNG.
3 replies →
It's more like "only I know how to find this keyhole". You still need the key then, you're just also adding some defense against picking.
It would be idiotic to use the knock as the only authentication, which is why I don't.
To be quite honest, I just like the aesthetics of it.
You're sending your knock over the public network in the clear. It's observable by anything in the path. And then you're not the only one that can find the keyhole.
Entirely true, it's not true security, same as changing the ssh port. So, relying on it for any security is not useful but it's a good deterrent from automated scans that are not targeted towards you. Defense in depth means not necessarily discarding flawed defenses if they are in addition to proper defense.