If it's set up properly, it could mean you don't have log files filled with login attempts since the SSH port won't open to them until a successful knock and the knocking doesn't have to be logged.

While port knocking is really just another layer of obscurity, obscurity works really well on scattershot/random attacks. An attacker dedicated to getting into your specific server is another matter but thankfully far more rare.

"While port knocking is really just another layer of obscurity, obscurity works really well on scattershot/random attacks."

Thank you. Remember - security through only obscurity is a bad idea, but additional layers of obscurity can be very valuable.

Also remember: a typical port knock is a series of three ports that all have to be hit in a certain timeframe - for instance, 2000, 4000, 8000 - that's a big "keyspace" to brute force through at WAN packet speeds ...

Ideally, your port-knocking service is much simpler and easier to audit than your ssh service. It's also much more obscure. So you have a service which is very unlikely to suffer a 0-day vulnerability listening all the time to engage a much more vulnerable service only at those exact times you need it.

What benefit does locking the glass doors into a bank add to having time-locked vault? Defense in depth.

The vault and the locked glass doors defend against entirely different things. Same doesn’t really apply for ssh keys and port knocking.

A port knock is just a clear password :/

I much prefer restricting port 22 to a few ip and disable passwords

Not with single packet authentication from fwknop

http://www.cipherdyne.org/fwknop/docs/fwknop-tutorial.html#w...

fwknop has a cache to prevent replay attacks, that plus the fact the packets are only valid for a certain length of time pretty much thwarts this. Remember, fwknop is _in addition_ to your existing security practices, it is not the only "password."

"A port knock is just a clear password"

It is only clear to the routers in your traceroute ... third party attackers cannot snoop on this traffic.

Right, exactly like a clear text password.