What SSH Hacking Attempts Look Like

Re:What SSH Hacking Attempts Look Like by petercooper on Saturday May 05, 2018 @08:59AM (#17001621)

If it's set up properly, it could mean you don't have log files filled with login attempts since the SSH port won't open to them until a successful knock and the knocking doesn't have to be logged.

While port knocking is really just another layer of obscurity, obscurity works really well on scattershot/random attacks. An attacker dedicated to getting into your specific server is another matter but thankfully far more rare.

[ Parent | on HN ]

Re:What SSH Hacking Attempts Look Like by rsync on Saturday May 05, 2018 @02:34PM (#17003106)

"While port knocking is really just another layer of obscurity, obscurity works really well on scattershot/random attacks."

Thank you. Remember - security through only obscurity is a bad idea, but additional layers of obscurity can be very valuable.

Also remember: a typical port knock is a series of three ports that all have to be hit in a certain timeframe - for instance, 2000, 4000, 8000 - that's a big "keyspace" to brute force through at WAN packet speeds ...

[ Parent | on HN ]