3 ms·
Port knocking is a ludicrous security measure compared to the combination of: * configuring sshd to only listen over a Wireguard tunnel under your control ( or
by philodeon 2y ago
Port knocking is a ludicrous security measure compared to the combination of:
* configuring sshd to only listen over a Wireguard tunnel under your control ( or letting something like Tailscale set up the tunnel for you)
* switching to ssh certificate authn instead of passwords or keys
- kazinator 2y agoDoes Wireguard work in such a way that there is no trace of its existence to an unauthorized contacting entity? I used port knocking for a while many years ago, but it was just too fiddly and flaky. I would run the port knocking program, and see the port not open or close. If I were to use a similar solution today (for whatever reason), I'd probably go for web knocking. In my case, I didn't see it as a security measure, but just as a way to cut the crap out of sshd logs. Log monitoring and banning does a reasonable job of reducing the crap.
- zekica 2y agoThat's one of the original design requirements for wireguard. Unless a packet is signed with the correct key, it won't respond at all.