4 ms·

If port knocking existing in a vacuum, sure. It'd be great. The issue is there are other options that are better - like VPN only access to SSH - that you can u

If port knocking existing in a vacuum, sure. It'd be great. The issue is there are other options that are better - like VPN only access to SSH - that you can use instead of (or in addition to) If everyone advocating for port knocking was also saying set up VPN only access, sure. It's an additional authorization factor via where ports are used as a proxy for a PIN. But I haven't seen a single person in here saying they use it in addition to a VPN - people are saying it's their primary form of protection. You can setup a wireguard VPN in as much time as it takes to set up port knocking. Now you have all of the benefits port knocking provides, and more. And you could even still set up port knocking in addition to the VPN if you really wanted to, but I would argue there's not much point.

surfsvammel 6y ago
Curious, how does this work? I am not very familiar with VPN. Is the VPN connection setup for the SSH session only? What if someone needs to have multiple SSH session, going to different networks altogether? Im thinking it could be pretty impractical to go onto a whole other network to open an SSH session.
- cthalupa 6y ago
  >Curious, how does this work? It depends on the implementation. For a client <-> server VPN, it creates an interface on your local machine that corresponds to the network address range for the VPN, and tunnels traffic to the remote end. For a site to site VPN, two appliances create a tunnel between them, and traffic is routed over that tunnel via the same sort of routing rules you normally use. > Is the VPN connection setup for the SSH session only? It can be. It can also be configured for all traffic, or some other combination. > What if someone needs to have multiple SSH session, going to different networks altogether? You can have multiple VPN connections to multiple networks. It can get complicated if the VPNs are using overlapping IP space. > Im thinking it could be pretty impractical to go onto a whole other network to open an SSH session. I'm not entirely sure why. Millions of people use VPNs every day for a variety of reasons, including SSH. I currently have 8 saved VPN configurations in my wireguard client, and connecting to one is as simple clicking on the client and picking the one I need in the dropdown. Then I SSH as normal, except its to the server's private IP and not public.

surfsvammel 6y ago

Curious, how does this work? I am not very familiar with VPN. Is the VPN connection setup for the SSH session only? What if someone needs to have multiple SSH session, going to different networks altogether? Im thinking it could be pretty impractical to go onto a whole other network to open an SSH session.

cthalupa 6y ago
>Curious, how does this work? It depends on the implementation. For a client <-> server VPN, it creates an interface on your local machine that corresponds to the network address range for the VPN, and tunnels traffic to the remote end. For a site to site VPN, two appliances create a tunnel between them, and traffic is routed over that tunnel via the same sort of routing rules you normally use. > Is the VPN connection setup for the SSH session only? It can be. It can also be configured for all traffic, or some other combination. > What if someone needs to have multiple SSH session, going to different networks altogether? You can have multiple VPN connections to multiple networks. It can get complicated if the VPNs are using overlapping IP space. > Im thinking it could be pretty impractical to go onto a whole other network to open an SSH session. I'm not entirely sure why. Millions of people use VPNs every day for a variety of reasons, including SSH. I currently have 8 saved VPN configurations in my wireguard client, and connecting to one is as simple clicking on the client and picking the one I need in the dropdown. Then I SSH as normal, except its to the server's private IP and not public.