3 ms·

For production use cases in a business environment it's just not as good as the alternatives. Setting up VPNs and blocking SSH access to the internet is just as

For production use cases in a business environment it's just not as good as the alternatives. Setting up VPNs and blocking SSH access to the internet is just as easy, less overhead, and more secure. Let's say you're a bank. You implement port knocking as your security measure of choice to keep SSH secure. I know from your job postings that your developers and IT department work at X location in Y city. I know the IP range of your public facing servers. I go to the closest coffee shops to that office, and drop off some wifi sniffers that record and send me all the communication to that IP range. All it takes is one of your employees doing some work on one of those servers from the coffee shop, and now I know your port knock sequence. Layer defeated. Or, you use a VPN. I do the same thing. All I see is VPN traffic. Maybe I can identify what type of traffic with DPI (unlikely to have the horsepower on the type of device you'd be leaving unattended at/near coffee shops for extended periods of time), but no real details on where that traffic is ultimately headed, and I have no ingress point given up to me. The VPN can also be used to secure other types of traffic beyond SSH. There's just not really any reason to use port knocking over a VPN when the difference in overhead and complexity is minimal and the benefits you get with a VPN vs. port knocking are so massive.

dec0dedab0de 6y ago
There's just not really any reason to use port knocking over a VPN when the difference in overhead and complexity is minimal and the benefits you get with a VPN vs. port knocking are so massive. But I would say in addition to a VPN, not instead of. Imagine the vpn client had it built in to do the knock, before connecting. So the VPN ports are not opened until the knock is performed and only for the source IP that did them.
- cthalupa 6y ago
  I mean, you could - it's not going to make things less secure to add port knocking - but I don't know that it makes things significantly more secure. The chances of there being public 0day exploits for a VPN and SSHD at the same time is pretty much zero, especially if you add in additional layers such as 2FA (which I would recommend doing) If someone is burning multiple private 0day exploits to target you then they are attackers at the level where port knocking is not likely to foil them either. (And to be clear, I just think that port knocking is a bit silly - not that it's totally ineffective, and it's not what I would call security through obscurity, since it is effectively another auth factor with a simple PIN)

dec0dedab0de 6y ago

There's just not really any reason to use port knocking over a VPN when the difference in overhead and complexity is minimal and the benefits you get with a VPN vs. port knocking are so massive. But I would say in addition to a VPN, not instead of. Imagine the vpn client had it built in to do the knock, before connecting. So the VPN ports are not opened until the knock is performed and only for the source IP that did them.

cthalupa 6y ago
I mean, you could - it's not going to make things less secure to add port knocking - but I don't know that it makes things significantly more secure. The chances of there being public 0day exploits for a VPN and SSHD at the same time is pretty much zero, especially if you add in additional layers such as 2FA (which I would recommend doing) If someone is burning multiple private 0day exploits to target you then they are attackers at the level where port knocking is not likely to foil them either. (And to be clear, I just think that port knocking is a bit silly - not that it's totally ineffective, and it's not what I would call security through obscurity, since it is effectively another auth factor with a simple PIN)