beefarino

Thanks, I appreciate the thoughtful response.

It sounds like port knocking and VPNs, while starkly different in approach, have some overlap in their approach to threat mitigation.

Wireguard et al are much better equipped to handle the needs of an organization, while port knocking's value trends to smaller teams, or even individuals.

I wouldn't want to manage knock rotations for 600 employees, for example.

I'm struggling to walk away with a crystallized view of why port-knocking is bad, though.

I do agree, nobody should be going to sleep at night, relying solely on obscurity as their source of protection. But these commenters are offering it as an additional layer of indirection. They're not touting it as _the_ solution, full stop.

At the most basic level, would you refute the claim that port knocking or alternate ports are adding additional friction for an attacker, or no?

Myself, I would prefer to run a simple, (hopefully) set-and-forget daemon on my server if it really did add an extra layer of obscurity to my secured SSH service.

I guess I just fail to see why it's one against the other.