But it's something.
You have to decide if the tradeoff between a thousand bot's scans and a sole eavesdropper noticing the knocking pattern and marking your host as "(incompetently) trying to hide" is really worth it.
Edit: heh, same thing is going on a few comments down :)
Not true. Modern port knocking is provably secure and requires network layer attacks to bypass.
More surface (both spiped and ssh are accepting connections):
|
→ |ssh
|
→ |spiped
|
→ | spiped ↝ | ssh
|
spiped is a tiny program, uses symmetric crypto (small surface). SSH isn't a tiny program, uses more complex asymmetric crypto (larger surface).
To learn more: http://www.daemonology.net/blog/2011-07-04-spiped-secure-pip...
To learn how to put it in front of SSH, see https://github.com/Tarsnap/spiped#example-usage
-> | SPA / fwknop | ssh
There are important differences too though (beyond the fact that SPA is not encrypting/decrypting traffic for SSH itself). SPA is a UDP authenticator so it cannot be scanned.
Design goals: http://www.cipherdyne.org/fwknop/docs/fwknop-tutorial.html#d...
Then the attacker can just compromise every single sshd on the internet and have enough bandwidth to bruteforce most port knocking setups.
If there's a remote-root buffer overflow for sshd that does not involve login at all, doesn't hiding the sshd add quite a bit of value ?
That is, there are attack vectors that we know exist, and that we have seen in the past many times for server daemons, that occur before, and override, any authentication mechanism.
By hiding the service, you take yourself out of that population of low hanging fruit ...
You don't find that valuable ? I personally find it extremely valuable and consider port knocking to be one of the very few security optimizations that has such low cost/complexity for such a pronounced and well defined gain. I would not think of deploying an Internet facing system without port knocking on the daemons that don't need public access.[1]