Re:Port knocking
by tptacek on Friday May 15, 2020 @01:29PM
(#23194814)
At the point where you're installing network cryptography tools to authorize access to your machine, why not just use a real cryptographic tunnel?
[ Parent
| on HN ]
Re:Port knocking
by juliusdavies on Friday May 15, 2020 @06:39PM
(#23198346)
I just prepend a secret letter to every possible ssh account on my server ('root' becomes 'jroot') and so that way "ssh [email protected]" can never work even if you know my root password. And this way my defense is opaque to attackers passively monitoring my network traffic (the username is encrypted in the ssh protocol).
Oh shit, I just gave away my secret on a public forum...
Ha ha, fooled you! I use a different secret letter in actual practice!
(Or do I?)
p.s. Pretty sure port-knocking offers less protection than this scheme.