5 ms·

I don't get the love for port knocking. If you need such a thing, wouldn't a proper VPN implementation be more robust? Edited to add: I'm asking for a clue.

I don't get the love for port knocking. If you need such a thing, wouldn't a proper VPN implementation be more robust? Edited to add: I'm asking for a clue. Thanks in advance. :)

est 10y ago
> wouldn't a proper VPN implementation be more robust? Suddenly your whole VPN infrastructure became an attack surface.
throwaway2048 10y ago
I trust openssh a hell of a lot more than any vpn software.
- lmm 10y ago
  Sure, but I also trust it a hell of a lot more than any port knocking implementation. If SSH is your point of trust... make it your point of trust. Throwing up an extra layer of obscurity on top doesn't help anything.
  - geographomics 10y ago
    If the port knocking was obscuring an unauthenticated root shell then you would have a good point, but this is a defence in depth measure that adds to the security. It helps because it's one more hurdle for an attacker to bypass.
    - lmm 10y ago
      Layering two actual security measures makes sense. Layering an obscurity measure on a security measure is not really any safer than just having the security measure, just as obscurity alone is not really any safer than nothing.
      - geographomics 10y ago
        It is a security measure, as it involves authentication through the series of knocks. It's a weak security measure on its own, so you obviously wouldn't want to rely on port knocking by itself, but it does have utility in preventing an attacker from discovering the service through a simple port scan. I don't quite understand why you're saying it adds nothing at all.
        ethbro 10y ago
        In essence, it's the same argument as "everyone should use encryption, even if it's barely non-trivial for state-level actors to break." You're not defending against the attacker who is targeting you with this. You're defending against the attacker who is targeting "anyone who is trivially accessible."

I don't get the love for port knocking. If you need such a thing, wouldn't a proper VPN implementation be more robust? Edited to add: I'm asking for a clue. Thanks in advance. :)

est 10y ago

> wouldn't a proper VPN implementation be more robust? Suddenly your whole VPN infrastructure became an attack surface.

throwaway2048 10y ago

I trust openssh a hell of a lot more than any vpn software.

lmm 10y ago
Sure, but I also trust it a hell of a lot more than any port knocking implementation. If SSH is your point of trust... make it your point of trust. Throwing up an extra layer of obscurity on top doesn't help anything.
- geographomics 10y ago
  If the port knocking was obscuring an unauthenticated root shell then you would have a good point, but this is a defence in depth measure that adds to the security. It helps because it's one more hurdle for an attacker to bypass.
  - lmm 10y ago
    Layering two actual security measures makes sense. Layering an obscurity measure on a security measure is not really any safer than just having the security measure, just as obscurity alone is not really any safer than nothing.
    - geographomics 10y ago
      It is a security measure, as it involves authentication through the series of knocks. It's a weak security measure on its own, so you obviously wouldn't want to rely on port knocking by itself, but it does have utility in preventing an attacker from discovering the service through a simple port scan. I don't quite understand why you're saying it adds nothing at all.
      - ethbro 10y ago
        In essence, it's the same argument as "everyone should use encryption, even if it's barely non-trivial for state-level actors to break." You're not defending against the attacker who is targeting you with this. You're defending against the attacker who is targeting "anyone who is trivially accessible."