Comment by TacticalCoder

Can we hear something from those who say that using port-knocking is "security through obscurity"?

Really: from the XZ backdoor in SSH (which went live on some distros) to this...

What's you rationale for calling port-knocking "security through obscurity" and not "defense in depth"?

Put it this way: if I advertize that my server is using port-knocking, that the sequence changes every 30 seconds (like TOTP) and that as soon one sequence is used, it's unusable (so you've only got one attempt to SSH in every 30 seconds, even if you know the sequence)...

Where's the security through obscurity?

But really: even if had musl and PasswordAuthentication allowed (I don't have neither), how would an attacker gets through the port knocking?

More fundamentally the question is: in which way is your system that does not use port knocking more secure than the one who do?

(remember: we're talking about remote exploits by simply having exposed TCP ports open or SSH listening)

Wanna have a talk too about the "solutions" proposed by "security experts" here "because SSH is too old" and that happen to be crufts on top of SSH that had remote root exploitable backdoors? (sorry, holes)