If the port knocking feature exists to "hide" your network service, you're saying the security of your service is based on the idea that nobody can see your traffic.
But if someone could see your traffic, and therefore your connection, and thus the port your service runs on, they could also clearly see the contents of your traffic. So port knocking would be useless, and everyone could see your traffic, and probably be able to do anything they wanted with it.
But since you use port knocking, you clearly believe nobody can see your traffic. So it then follows that you don't need encryption.
So clearly you should be using telnet.
This is just an absurd statement. You have conflated to completely separate issues.
you're saying the security of your service is based on the idea that nobody can see your traffic.
No, it's because no one can find the service, not see the traffic.
1. Anyone who can see your traffic can see where the service is.
2. We assume anyone can see your traffic because you're using an encrypted connection. (The conversation should have stopped here, but i'll continue anyway...)
3. The only thing port knocking does is obscure your service from port scanning.
4. The equivalent method to preventing someone finding your service via port scanning is changing the port number.
5. Changing the port number prevents all non-direct-attacks from finding your service. (Nobody scans every TCP+UDP port of every IP on the internet for one service, because 563.6 trillion network packet send+recvs takes a long time, which doesn't even factor multiple tries or error retransmissions).
6. A direct attack by a committed attacker will eventually find your network service.
7. Port knocking does not add to security. It partially obscures information, but it does not prevent access, and it operates on faulty assumptions about network security; the information is still there, you just have to look for it differently. It is less reliable than even IP whitelisting.
8. In the real world (and not the "gee I think this sounds more secure" theoretical world) every single other network service you have will be exploited before OpenSSH. So trying to hide OpenSSH while not hiding your other services becomes farcical.
Dude, right there you lost me. 99.99999999% of the internet can't see your traffic. The NSA can. Your ISP can. Random threats on the 'net at large cannot see your traffic.
Ways I can see your traffic:
* fucking with bgp
* fucking with routers in general
* fucking with switch port tables
* fucking with proxies
* spoofing
* sniffing wireless networks
* sniffing wired networks
* tapping a cage backbone
* rooting an isp
* rooting a dslam
* rooting pops
* rooting firewalls
* rooting endpoints on management ports
* abusing hosted networks
Don't assume that just because you aren't aware of a particular attack that it doesn't exist or doesn't apply to you. Hackers are only limited by their creativity.
Please don't trust the network.
What is the state of grsec on FreeBSD ? I'm not sure...
Answer to #3 is yes.
I don't use a full-blown VPN in a lot of cases because it's a lot of complexity that isn't needed. knockd is extremely simple (look at the source) and simple to use.
---
This is the way all discussions about port knocking go:
"I like port knocking"
"But port knocking is not the christ child that will deliver us from all of the evils of the world!"
No, it's not. It simply adds a small amount of incremental security at almost zero cost. All else being equal, my sshd was visible before, and now it's not.