40 ms·
If it's set up properly, it could mean you don't have log files filled with login attempts since the SSH port won't open to them until a successful knock and th
by petercooper 9y ago
If it's set up properly, it could mean you don't have log files filled with login attempts since the SSH port won't open to them until a successful knock and the knocking doesn't have to be logged.
While port knocking is really just another layer of obscurity, obscurity works really well on scattershot/random attacks. An attacker dedicated to getting into your specific server is another matter but thankfully far more rare.
- rsync 9y ago"While port knocking is really just another layer of obscurity, obscurity works really well on scattershot/random attacks." Thank you. Remember - security through only obscurity is a bad idea, but additional layers of obscurity can be very valuable. Also remember: a typical port knock is a series of three ports that all have to be hit in a certain timeframe - for instance, 2000, 4000, 8000 - that's a big "keyspace" to brute force through at WAN packet speeds ...