Re:Changes sshd port every 30 seconds, using Two Factor Auth...
by rsync on Sunday May 29, 2016 @12:54PM
(#11797047)
"I don't understand why this is seen as acceptable, yet port knocking is derided every time it's brought up."
I have been in this business for a long time and I still look very fondly at port-knocking as a thing that genuinely makes things better.
Almost zero complexity added, super stable knockd daemon, and does a single, simple thing very, very well.
I love port knocking, I love using it, I love the idea of it, and I wouldn't build a server without hiding sshd (and others) behind a knock.
All criticism of port knocking (weirdly) assumes that you also disable all other forms of security and that you rely solely on port knocking, which of course is false.
It is true that port knocking adds just a marginal additional amount of security, but it's still additive and it's still a high return on the (very low) complexity and maintenance.
I have been in this business for a long time and I still look very fondly at port-knocking as a thing that genuinely makes things better.
Almost zero complexity added, super stable knockd daemon, and does a single, simple thing very, very well.
I love port knocking, I love using it, I love the idea of it, and I wouldn't build a server without hiding sshd (and others) behind a knock.
All criticism of port knocking (weirdly) assumes that you also disable all other forms of security and that you rely solely on port knocking, which of course is false.
It is true that port knocking adds just a marginal additional amount of security, but it's still additive and it's still a high return on the (very low) complexity and maintenance.