> Security by obscurity alone is bad, but as another layer, it can be great. I beg to differ in your case. Had you left SSH on its default port, what would yo

> Security by obscurity alone is bad, but as another layer, it can be great. I beg to differ in your case. Had you left SSH on its default port, what would your expected time-to-compromise be? Presumably you weren't using a root:password credential, or else your system would not have remained up enough long enough for you to implement any obscurity. But if an attacker, with full ability to try logins, could not reasonably guess your login credential in the lifetime of the universe (i.e. public key SSH or a strong password), then you've not improved security by moving to a port-knocking model. You have reduced nuisance, but nuisance isn't part of the standard threat model for SSH security. To put it another way: you've not seen another unauthorized login attempt, but would you be comfortable relying on that and use root:password as your access credential?