3 ms·
I do, indeed, highly value port knocking and I use it in my personal infrastructure. It is simple and elegant and we're coming up on ~20 years of deployment in
by rsync 3y ago
I do, indeed, highly value port knocking and I use it in my personal infrastructure.
It is simple and elegant and we're coming up on ~20 years of deployment in various places with zero hangs or crashes or unexpected interactions.
While nobody should rely solely on port knocking, it is a wonderful layer added to a defense-in-depth strategy.
Which is to say: lock down everything the way you always do, then put the port behind a knock.
- out-of-ideas 3y agoI actually want to do this (one day i'll get to nerd-out again) but then tie it to a totp setup so the knocking-algorithm changes ever so slightly; could even utilize different ports
- rsync 3y agoResist, resist. The knock utility (and associated knockd daemon) are simple and resilient - don't make it more complex. Instead, add a simple line to your .login (or whatever) that sends you an SMS every time a successful (three packet) knock occurs. You're the only one that should perform that ... so it would be very interesting if a successful knock occurred without your having knocked ...
- out-of-ideas 3y agosounds fun; i see the arch aur has a few options as well. have you tried https://www.cipherdyne.org/fwknop/ https://www.cipherdyne.org/fwknop/ ?